[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Linux kernel hardening - link restrictions



On Thu, 2012-03-01 at 21:40 -0800, Kees Cook wrote:
> On Fri, Mar 02, 2012 at 05:11:58AM +0000, Ben Hutchings wrote:
> > The longstanding link restriction patches were recently accepted by
> > Andrew Morton and are likely to end up in Linux 3.4.  I've applied
> > these to src:linux-2.6 in svn and they should end up in the upcoming
> > version 3.2.9-1.
> 
> That's excellent news! (I am biased, obviously.)
> 
> > We know that these are going to break some programs, most notably
> > 'at' (#597130, fixed in wheezy/sid).  But of course it's possible
> > to work around that by disabling the restriction, so I don't think
> > this should result in a 'Breaks' relation.
> 
> FWIW, as some background, "at" is the only package that I'm aware of
> breaking across 1.5 years of (a version of) this patch living in Ubuntu,
> and in many more years living in Openwall Linux and grsecurity. So I
> feel like "going to break some" is strong. :)
[...]
> It's a trivial patch[1] to fix "at". How about just backporting that
> change to stable, to avoid that known trouble too? This is what Ubuntu
> did for the Lucid LTS release that was getting backported kernels (with
> link restrictions) built for it.

Ansgar, are you happy to do a stable update for this?  If so, we can put
'Breaks: at (<< 3.1.12-1+squeeze1)' in the kernel packages for wheezy
and hopefully APT will just do the right thing without users having to
read NEWS (which doesn't get translated).

Ben.

-- 
Ben Hutchings
One of the nice things about standards is that there are so many of them.

Attachment: signature.asc
Description: This is a digitally signed message part


Reply to: