[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Linux kernel hardening - link restrictions



On Thu, 2012-03-08 at 12:19 +0100, Vincent Lefevre wrote:
> Hi,
> 
> On 2012-03-02 05:11:58 +0000, Ben Hutchings wrote:
> > I'm therefore intending to warn about this with the following NEWS
> > entry in the linux-image metapackages:
> > 
> > Index: debian/linux-image.NEWS
> > ===================================================================
> > --- debian/linux-image.NEWS	(revision 18757)
> > +++ debian/linux-image.NEWS	(working copy)
> > @@ -1,3 +1,18 @@
> > +linux-latest (44) unstable; urgency=low
> > +
> > +  * The new kernel version includes security restrictions on links, which
> > +    are enabled by default.  These are specified in
> > +    Documentation/sysctl/fs.txt in the linux-doc-3.2 and linux-source-3.2
> > +    packages.
> > +  
> > +    These restrictions may cause some legitimate programs to fail.
> > +    In particular, if the 'at' package is installed, you should either:
> > +    - Upgrade it to at least version 3.1.13-1 (or a backport of that)
> > +    or:
> > +    - Set sysctl fs.protected_hardlinks=0 (see /etc/sysctl.conf)
> > +
> > + -- Ben Hutchings <ben@decadent.org.uk>  Fri, 02 Mar 2012 04:58:24 +0000
> > +
> >  linux-latest-2.6 (26) unstable; urgency=low
> >  
> >    * The old IDE (PATA) drivers are no longer developed.  Most PATA
> > --- END ---
> > 
> > (Why in the metapackages, you ask?  Because apt-listchanges shows NEWS
> > from upgraded packages, not new packages.)
> 
> I didn't see anything! (I noticed the change thanks to a diff on
> "sysctl -a" output, otherwise I wouldn't be aware of it.)
[...]

Since 'at' is going to be updated in stable, I added a versioned
'Breaks' instead.

Ben.

-- 
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.

Attachment: signature.asc
Description: This is a digitally signed message part


Reply to: