Re: [gentoo-user] Ghost cyber threat

[Grant]

>> glsa-check is working fine, it was a slotted issue.  Still curious
>> about a way to check for statically linked packages.
>
> There is no simple solution for this... USE flags static and
> static-libs handle cases where there is a choice between static and
> non-static version. In theory it is possible that some package
> (like boot loader helper) can be linked only statically, thus you
> will not be able to find it by USE flag. Though probability of this
> is very low, and due to a special nature of such binaries (or
> libraries) attack surface is even less.
>
> So you may assume your system reasonable secure if:
> - all GLSAs are applied;
> - there are no preserved libraries left (all packages using
> vulnerable libs must be rebuilt);
> - all static binaries and libraries depending directly or
> indirectly on vulnerable packages are rebuild;
> - there are no running processes using deleted files (reboot is a
> brute, but effective way to do this, otherwise one should grep lsof
> -n output for "(deleted)" files in use).


I think 'checkrestart' is a good substitute for this.


> - kernel should be updated to the latest version in branch if it is
> still supported, or upgrade to another branch, preferably LTS, if
> it is EOLed already.
>
> I have not seen GLSAs for kernel in ages, though old kernels
> definitely have serious security issues, and they may be far more
> serious than Ghost glibc bug.


I didn't know that, thank you.

- Grant