[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1113774: Disabling -fcf-protection in sudo for bookworm



Hi,

On Tue, Sep 02, 2025 at 11:28:22AM -0400, Paul Tagliamonte wrote:
The natural outcome here seems to be:

 a) do nothing as-is, some fraction of supported but non-intel CPUs will
get runtime failures, since we've altered the ISA baseline and never realized it due to popularity

b) remove this flag from sudo specifically, fixing sudo specifically in bookworm (oldstable)

c) change all i386 package flags for bookworm specifically (oldstable) and binNMU the whole archive, FTBFS and all

 d) declare bookworm i386 retroactively always was a different ISA baseline
    ("We have always been at war with Eastasia")

What I don't understand is why those people running those rather exotic machines don't just run another privilege escalation tool like runas or compile their own sudo package.

I would be willing to provide a signed and patched sudo outside the debian archive (we still do have people.debian.org, right?) to get this settled if we can't find consensus that the change is indeed harmless.

Greetings
Marc

--
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421


Reply to: