1 |
On 9-Feb-04, at 7:11 AM, Calum wrote: |
2 |
|
3 |
> What I think would be a good idea is the creation and maintenance of |
4 |
> say 4 new |
5 |
> virtual packages: |
6 |
> remote-root |
7 |
> remote-shell |
8 |
> local-root |
9 |
> remote-dos |
10 |
> (Maybe there could be more, but these are the ones that I can think |
11 |
> of). |
12 |
|
13 |
Couple of comments. |
14 |
|
15 |
This doesn't make sense to me personally, emerge remote-root sounds |
16 |
more like something you would do to obtain remote root of a machine |
17 |
than to repair a potential one (just terminology stuff there is my |
18 |
complaint). In theory the idea seems valid, in practice I'm not sure |
19 |
this would be the best approach. |
20 |
|
21 |
What I would rather see in portage is a way to rank updates (10 for |
22 |
trivial, 5 for major version upgrades with more features, etc, and 1 |
23 |
for security needs). Then something like emerge -up -L1 world might |
24 |
only show any major security updates you need to do along with the |
25 |
required deps (but hopefully not optional ones). This should be fairly |
26 |
achievable with minor changes to the low levels (to add metadata for |
27 |
the update's urgency), and maybe 10-15 lines in the portage code base. |
28 |
|
29 |
Second comment.. the 'virtuals' you compare the 'remote-root' pkg vs. |
30 |
system pkg with work radically differently than what might be the |
31 |
initial assumption. In fact world and system are both very different |
32 |
than the typical metapkgs (like kde, gnome, etc). They are both hard |
33 |
coded into the setup so to speak. System being defined in the profile |
34 |
(pkgs marked with * in packages file are system files), and world is |
35 |
maintained similarly (yet differently) in your portage db directory in |
36 |
a flat file (it keeps running tabs on what's installed, etc). |
37 |
|
38 |
I for one would much rather see a severity level of some sort happen in |
39 |
portage, for those of us that are afraid to emerge -u world to fix |
40 |
these sorts of vulnerabilities (as you never know what you are getting |
41 |
into with that if you run a very locked down server), which would also |
42 |
give us a very quick way of assessing what if any updates are needed |
43 |
for security reasons without having to do a lot of digging my hand or |
44 |
comparing versions vs. all kinds of GLSA announcements, etc. |
45 |
|
46 |
On that note it would be even better if at the end of emerge sync it |
47 |
could give you a message telling you that there are some level 1 |
48 |
security updates available and how to view the list of them, similarly |
49 |
to how it tells you that there are portage updates available. |
50 |
|
51 |
Mark |
52 |
|
53 |
|
54 |
-- |
55 |
gentoo-security@g.o mailing list |