[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: portmap (was Re: SECURITY PROBLEM: autofs [all versions])



On Thu, Jul 06, 2000 at 12:45:05PM -0400, Christopher W. Curtis wrote:
> The problem with that is that upgrading the package restores the
> symlinks.  Making them K* links preserves them, but then there's
> "symlink clutter"(?).  Not really a big deal, imo, but I guess it hints
> at a larger problem...

What a lot of nonsense.

portmap is in netbase because that's where it's always been. It might
be nice to move it out, but that's not going to happen today, and really
there are a lot more interesting and useful things to worry about.

You have to leave exactly one symlink about for update-rc.d to not
change anything, which, sure, you can call clutter if you're obsessive
compulsive, but in comparison to, say, /usr/doc, or /var/lib/dpkg/info
it's absolutely nothing.

More problematic though, is that netbase and friends not only rerun
update-rc.d on upgrades, but they also restart the service (or run
/etc/init.d/* restart or something similar anyway). So even replacing
all the S* symlinks with K* symlinks, you can still end up with portmap
(or whatever) running when you don't want it. The only correct way to
handle this at the moment is by adding an exit 0 somewhere in your init.d
script. It's ugly, but it works.

A much better solution is possible, but it requires some scripts to be
distributed with dpkg/sysvinit and filerc, and it requires maintainers
to change their calls to /etc/init.d/* restart (or whatever), and some
policy updates to document the new requiremnets. People seem quite happy
to keep complaining about this, but that's been done already, if you
want to do something useful, get the stuff organised make the policy
proposal and generally get a better, working system ready and deployed.

Cheers,
aj, using Christopher's post as a starting point rather than replying
    to it per se.

-- 
Anthony Towns <aj@humbug.org.au> <http://azure.humbug.org.au/~aj/>
I don't speak for anyone save myself. GPG signed mail preferred.

  ``We reject: kings, presidents, and voting.
                 We believe in: rough consensus and working code.''
                                      -- Dave Clark

Attachment: pgpg33wXtAbBL.pgp
Description: PGP signature


Reply to: