[gentoo-dev] addwrite abuse

[Joshua Brindle]

I grepped through portage today and it appears that there are a large 
number of ebuilds that abuse addwrite in bad (potentially dangerous) ways.

I'll spare the list at this time and ask that anyone maintaining such an 
ebuild *please* try to fix it (patch, bug upstream, etc) so that it 
isn't required. This is both for the safety of gentoo users and for 
security.

Pebenito has also started work on an SELinux based sandbox (does the 
same thing as sandbox, just limits it using SELinux domains for SELinux 
users). Since it wouldn't have the ability to do these arbitrary rule 
additions all these ebuilds would fail.

Thanks

Joshua Brindle

--
gentoo-dev@g.o mailing list