Re: [gentoo-security] Idea for easily checking for security updates.

[Ed Grimm]

On Mon, 9 Feb 2004, Roman Kennke wrote:

> Personally, I like the way it's done in NetBSD: There is a pkg called
> 'audit-packages', which has 2 tools: download-vulnerability-list, which
> does exactly that: download a current list (maintained by the NetBSD
> security team) of pkgs, that are vulnerable (with version of course), and
> a tool audit-packages, which checks all installed pkgs against this list.
>  The clou is, that this tool integrates with the build system (emerge in
> Gentoo), and regularily tells you about packages which would need a
> security update, when you update/install a package. Include these tools
> in crontab, let yourself send the output of audit-packages and you're
> somewhat safe about the packages on your system.

This sounds pretty good.  If each report includes URLs to descriptions
of the problem (whether it's on the product's webpage, Gentoo's web
page, CERT, SANS, or any of the various other orgs tracking this sort of
thing, I don't care - I'd actually expect such a thing to mix and match
as appropriate), and if there is a way to mask by both package and bug,
then I'm not sure I could find many things to complain about on it.
Well, speed.  I have a P1 166; I can always complain about speed.

(Some packages, such as dhcpcd, are currently installed because the
system chose to install them, and I haven't yet tracked the dependency
train to find out what requires them.  But they're never used, so I
don't care about security holes in them (unless, of course, it's a local
priviledge escalation exploiting setuid, except that none of them have
setuid.)  But most of the time, I just happen to know that the big bad
bug in foo is one that doesn't afflict my configuration.)

Ed

--
gentoo-security@g.o mailing list