Gentoo Archives: gentoo-kernel

From: Mathieu SEGAUD <mathieu.segaud@××××××.cx>
To: gentoo-kernel@l.g.o
Subject: Re: [gentoo-kernel] What is the policy for a security fix for kernel?
Date: Fri, 05 Dec 2008 15:42:14
Message-Id: 87ljuupr08.fsf@barad-dur.regala.cx
In Reply to: [gentoo-kernel] What is the policy for a security fix for kernel? by Bruno Buss
1 Vous m'avez dit récemment :
2
3 > Hi,
4
5 hi,
6
7
8 > For example, bug 249729 (http://bugs.gentoo.org/show_bug.cgi?id=249729) is a
9 > security bug that affect a lot of versions (
10 > http://www.securityfocus.com/bid/32516/info).
11 > Also, i may be wrong... i don't think it is a very dangerous bug... but it
12 > is a security bug anyway.
13 >
14 > So, what the KernelTeam do in this case?
15 >
16 > First, genpatches and gentoo-sources have in cvs-trunk 2.6.25, 2.6.26,
17 > 2.6.27 and now is creating the structure for 2.6.28. But let focus on .25,
18 > .26 and .27 that are the stable kernel releases.
19 >
20 > For .27, the 2.6.27.8 stable review cycle is in process, so when it's
21 > released, KernelTeam just update genpatches to have 2.6.27.8 patch and
22 > release 2.6.26-r4? And ask for stabilization?
23 >
24 > For .26, backport to genpatches and release 2.6.26-r4?
25 > Same for .25, and release 2.6.25-r10?
26 > (Or if the patch just apply with no problems, just get it and put it in
27 > there.)
28
29 it applies cleanly on top of both trees, compiles, boots and runs cool.
30 However, this "fix" doesn't fix all the issues, it just avoids OOM to be
31 triggered, but, softlockups can still take out your mental sanity, and
32 most of it, any instance of X is hardlocked up (by unix sockets
33 starvation). I really don't know of any real benefit...
34
35 > The older versions, are not suported by genpatches anymore... but they
36 > should stay marked as stable, even with security bugs?
37
38 I don't know about it
39
40 > And what is the procedure for the sys-kernel/vanilla-sources ebuilds? Leave
41 > it as it is? Try to stabilize any new version? Take out any version or put ~
42 > back in them?
43
44 as far as I can see, vanilla-sources are just ebuilds providing "as-is"
45 _vanilla_ kernel trees. if there are new official vanilla versions,
46 there are provided thru new ebuilds. if no 2.6.26.x is released fixing
47 this ou that -- which is very likely -- no ebuild will be added.
48
49 --
50 Mathieu