Olle Eriksson wrote:
Hi What is the difference between the kernel source from kernel.org and the Debian kernel-source-* packages? The only thing I can find about that is some discussion from 1997 concluding that there is no difference except that the debian packages handles the /usr/src/linux symlink for you. Sorry if I am missing some obvious docs now.
The Debian kernels contain certain additional patches, and also
security patches. So, if you run Woody and have kernel-source-2.4.18
installed with version number 2.4.18-14.2, then you have a 2.4.18
source tree that is patched against all the vulnerabilities discovered
since its realease.
Here is an excerpt from the changelog:
kernel-source-2.4.18 (2.4.18-14.2) stable-security; urgency=high
* Non-maintainer upload by the Security Team
* Applied patch extracted from Solar Designer's Owl patched kernel to
fix local privilege escalation discovered by Paul Starzetz
(CAN-2004-0077)
-- Martin Schulze <joey@infodrom.org> Sat, 31 Jan 2004 16:58:14 +0100
kernel-source-2.4.18 (2.4.18-14.1) stable-security; urgency=high
* Non-maintainer upload by the Security Team
* Applied patch by Andrea Arcangeli to fix local privilege escalation
discovered by Paul Starzetz (CAN-2003-0985)
-- Martin Schulze <joey@infodrom.org> Mon, 5 Jan 2004 16:37:09 +0100
If you were using the kernel.org sources, you would need to do this
yourself manually, or upgrade to version 2.4.25.
And, about that /usr/src/linux symlink. I have installed new kernels from the kernel-source packages a few times and I have never seen this symlink on my system. Is it safe to be without it?
IIRC, /usr/src/linux is only needed if you decide to compile a new libc on your own. Otherwise, it is unnecessary.
The reason I am asking is that I am in the process of downloading the source for 2.6.3 from kernel.org and install it on my unstable system.
See my above note about tracking the kernel.org sources.
Thanks Olle Eriksson
-Roberto Sanchez
Attachment:
signature.asc
Description: OpenPGP digital signature