Gentoo Logo
Gentoo Spaceship




Note: Due to technical difficulties, the Archives are currently not up to date. GMANE provides an alternative service for most mailing lists.
c.f. bug 424647
List Archive: gentoo-kernel
Navigation:
Lists: gentoo-kernel: < Prev By Thread Next > < Prev By Date Next >
Headers:
To: gentoo-kernel@g.o
From: Mathieu SEGAUD <mathieu.segaud@...>
Subject: Re: What is the policy for a security fix for kernel?
Date: Fri, 05 Dec 2008 16:43:03 +0100
Vous m'avez dit r├ęcemment :

> Hi,

hi,


> For example, bug 249729 (http://bugs.gentoo.org/show_bug.cgi?id=249729) is a
> security bug that affect a lot of versions (
> http://www.securityfocus.com/bid/32516/info).
> Also, i may be wrong... i don't think it is a very dangerous bug... but it
> is a security bug anyway.
>
> So, what the KernelTeam do in this case?
>
> First, genpatches and gentoo-sources have in cvs-trunk 2.6.25, 2.6.26,
> 2.6.27 and now is creating the structure for 2.6.28. But let focus on .25,
> .26 and .27 that are the stable kernel releases.
>
> For .27, the 2.6.27.8 stable review cycle is in process, so when it's
> released, KernelTeam just update genpatches to have 2.6.27.8 patch and
> release 2.6.26-r4? And ask for stabilization?
>
> For .26, backport to genpatches and release 2.6.26-r4?
> Same for .25, and release 2.6.25-r10?
> (Or if the patch just apply with no problems, just get it and put it in
> there.)

it applies cleanly on top of both trees, compiles, boots and runs cool.
However, this "fix" doesn't fix all the issues, it just avoids OOM to be
triggered, but, softlockups can still take out your mental sanity, and
most of it, any instance of X is hardlocked up (by unix sockets
starvation). I really don't know of any real benefit...

> The older versions, are not suported by genpatches anymore... but they
> should stay marked as stable, even with security bugs?

I don't know about it

> And what is the procedure for the sys-kernel/vanilla-sources ebuilds? Leave
> it as it is? Try to stabilize any new version? Take out any version or put ~
> back in them?

as far as I can see, vanilla-sources are just ebuilds providing "as-is"
_vanilla_ kernel trees. if there are new official vanilla versions,
there are provided thru new ebuilds. if no 2.6.26.x is released fixing
this ou that -- which is very likely -- no ebuild will be added.

-- 
Mathieu


References:
What is the policy for a security fix for kernel?
-- Bruno Buss
Navigation:
Lists: gentoo-kernel: < Prev By Thread Next > < Prev By Date Next >
Previous by thread:
What is the policy for a security fix for kernel?
Next by thread:
[ANNOUNCE] genpatches-2.6.27-7 release
Previous by date:
What is the policy for a security fix for kernel?
Next by date:
[ANNOUNCE] genpatches-2.6.27-7 release


Updated Jun 17, 2009

Summary: Archive of the gentoo-kernel mailing list.

Donate to support our development efforts.

Copyright 2001-2013 Gentoo Foundation, Inc. Questions, Comments? Contact us.