[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Uploading openssh NMU for SELinux updates as per release policy

On 27 Oct 2006 13:26:53 +0100, Matthew Vernon <matthew@debian.org> said: 

> Manoj Srivastava <srivasta@debian.org> writes:
>> Hi,
>> Three days ago, I sent in a patch in Bug#394795 which updated
>> SELinux patches to bring 'em in line with currently released
>> SELinux code in Debian.  I updated that patch [0], and the binaries
>> were

> I know nothing about SELinux, so can't really comment on the
> patch. In general, however, we encourage people wanting to patch
> openssh to talk to upstream first: Trying to maintain substantial
> patch-sets between openssh relseases just causes pain, particularly
> if the feature involved is later implemented in upstream openssh,
> with differing config options &c. Furthermore, if upstream don't
> like a patch, we are naturally reluctant to deploy it ourselves.

        That is an admirable policy, especially when applied to new
 features. However, openssh already has SELinux -- but there is a wee
 bit of bit-rot setting in.  SELinux has changed; the SELinux
 infrastructure shipping in Etch is different fro the one that the
 patches are based on.  It would be a bug if the features of SELinux
 were degraded (MLS levels being set to the default, low capability
 ones) if one used ssh to log in as opposed to directly logging in. 

        So, since this is just bringing bits of openssh in line with
 the version of SELinux we ship, I think it would be a bug _not_ to
 update the SELinux code in openssh.

> Have the bits of this patch that aren't Debian-specific been even
> shown to upstream? If not, please don't go slamming them willy-nilly
> into Debian's openssh.

        This change brings us in line with the fedora amd gentoo
 SELinux patches. so it might help getting it upstream,

If puns were deli meat, this would be the wurst.
Manoj Srivastava <srivasta@debian.org> <http://www.debian.org/~srivasta/>
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C

Reply to: