Gentoo Archives: gentoo-hardened

From: Kerin Millar <kerframil@×××××.com>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] hardened glibc downgrade
Date: Fri, 13 Feb 2009 18:49:25
Message-Id: 279fbba40902131049n4cceb80dm51440beb35791d28@mail.gmail.com
In Reply to: Re: [gentoo-hardened] hardened glibc downgrade by Guillaume Castagnino
1 2009/2/13 Guillaume Castagnino <casta@×××××.info>:
2 > Le vendredi 13 février 2009 18:48:03, Gordon Malm a écrit :
3 >> On Friday, February 13, 2009 09:15:18 Guillaume Castagnino wrote:
4 >> > In fact, no: glibc-2.9 was allready keyworded on hardened ~x86 in the
5 >> > portage tree, and not masked until 2009-02-11.
6 >> > So ~x86 hardened was naturally upgraded to glibc 2.9 without any
7 >> > intervention.
8 >>
9 >> And naturally if you're running ~ARCH you should know how to
10 >> manipulate /etc/portage.
11 >>
12 >> > I have no problem to package.unmask it, it's just to know what is the
13 >> > reason for this mask :)
14 >>
15 >> Because sys-libs/glibc-2.8 is about to go stable and stable hardened is not
16 >> ready for it.
17 >>
18 >> > But keep in mind that for ~x86 hardened, this mask has a dependency
19 >> > problem, since ~x86 iproute2 depends on glibc that is now masked on
20 >> > ~x86 hardened (and was not before 2009-02-11)
21 >>
22 >> So put sys-libs/glibc into /etc/portage/package.unmask.
23 >
24 > Yes of course.
25 > I perfectly know how to do to fix this problem *for me* as ~arch user for many
26 > years.
27 >
28 >
29 > But what I want to point, is that currently, depdency tree seems to be broken
30 > for ~x86 : some packages in the ~x86 tree (iproute2 for example) ask for
31 > package not available in ~x86 (glibc).
32 > Doesn't it sounds wrong to have such situation in the official tree ?
33 >
34
35 It is not ideal but, as has already been established, it poses only
36 the most trivial inconvenience for users such as yourself. On the
37 other hand, if that is what it takes to be absolutely assured that
38 Hardened Gentoo users who are using the stable tree will continue to
39 have a functional system then it is surely a sensible precaution on
40 the part of the maintainer. The needs of this demographic should not
41 be (potentially) jepoardized so as to prevent the ~arch users from
42 having to enter a single line into package.unmask. Under the
43 circumstances, what would you have done?
44
45 In terms of how other packages are stabilised, bear in mind that the
46 developers concerned - unlike Gordon - will seldom have the interests
47 of the Hardened userbase first and foremost in their minds ... a
48 situation exacerbated by the current disparity between the vanilla and
49 hardened toolchain/kernel versions and the limited manpower at the
50 disposal of the project. Nevertheless, things continue to move
51 forwards but there will be occasions - such as this - where special
52 measures need to be enacted.
53
54 Those of us using a bleeding-edge toolchain might consider thoroughly
55 testing the current stable kernel so as to determine whether this
56 precaution is indeed necessary.
57
58 Regards,
59
60 --Kerin