[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: setuid/setgid binaries contained in the Debian repository.



Manoj Srivastava wrote:
> 	This seems like a good practice kind of recommendation, not an
>  requirement, and as such, may be better suited to be included
>  in developers reference rather than policy, don't you think?

I agree that policy can't force developers to do that, but policy is
already full of such recommendatons:

1.
     You should not specify a `Pre-Depends' entry for a package before this
     has been discussed on the `debian-devel' mailing list and a consensus
     about doing that has been reached.

2.
     You must not tag any packages `essential' before this has been
     discussed on the `debian-devel' mailing list and a consensus about
     doing that has been reached.

3.
     You should not tag any packages as belonging to a task before this has
     been discussed on the _debian-devel_ mailing list and a consensus
     about doing that has been reached.

4.
     This will use a default sequence number of 20.  If it does not matter
     when or in which order the `init.d' script is run, use this default.
     If it does, then you should talk to the maintainer of the `sysvinit'
     package or post to `debian-devel', and they will help you choose a
     number.

5.
     If this case happens, one of the programs
     must be renamed.  The maintainers should report this to the
     `debian-devel' mailing list and try to find a consensus about which
     program will have to be renamed.  If a consensus cannot be reached,
     _both_ programs must be renamed.

6.   (on perms and users)
     If necessary you may deviate from the details below.  However, if you do
     so you must make sure that what is done is secure and you should try
     to be as consistent as possible with the rest of the system.  You
     should probably also discuss it on `debian-devel' first.

7.
     In this case you should choose an
     appropriate user or group name, discussing this on `debian-devel' and
     checking with the `base-passwd' maintainer that it is unique and that
     they do not wish you to use a statically allocated id instead.

8.
     It is often worthwhile contacting such
     authors diplomatically to ask them to modify their license terms.
     However, this can be a politically difficult thing to do and you
     should ask for advice on the `debian-legal' mailing list first, as
     explained below.

9.
     When in doubt about a copyright, send mail to
     <debian-legal@lists.debian.org>.  Be prepared to provide us with the
     copyright statement.

Do you plan to move all these to the developer's reference? It would bloat
the developer's reference with references to specific sections of policy,
and leave the policy full of holes with no recommendations as to a good
course of action or even a mention that a given action is potentially
hazardous.

I remember having this exact same discussion when #3 above was added to
policy, BTW.

-- 
see shy jo

Attachment: pgpt4Jrk7PYl2.pgp
Description: PGP signature


Reply to: