[gentoo-dev] 2.6.31 stable plans

[gentoo-dev] 2.6.31 stable plans

[Mike Pagano]

I'm planning to request the stabling of gentoo-sources-2.6.31 on November 
13th, a little more than 1 week from now. We have a few regressions we are 
tracking but they are not far reaching and most are close to resolution. We 
will follow up on all unresolved regressions.

Regressions in external packages in the stable tree are tracked in bug 
#291927. If any arise, please make every effort to fix these.

Thanks,
Mike Pagano

-- 
Mike Pagano
Gentoo Developer - Kernel Project
E-Mail     : mpagano@gentoo.org
GnuPG FP   : EEE2 601D 0763 B60F 848C  9E14 3C33 C650 B576 E4E3
Public Key : http://pgp.mit.edu:11371/pks/lookup?search=0xB576E4E3&op=index

Re: [gentoo-dev] 2.6.31 stable plans

[Nirbheek Chauhan]

On Thu, Nov 5, 2009 at 5:08 AM, Mike Pagano <mpagano@gentoo.org> wrote:
> I'm planning to request the stabling of gentoo-sources-2.6.31 on November
> 13th, a little more than 1 week from now. We have a few regressions we are
> tracking but they are not far reaching and most are close to resolution. We
> will follow up on all unresolved regressions.
>
> Regressions in external packages in the stable tree are tracked in bug
> #291927. If any arise, please make every effort to fix these.
>

Are there any plans to stabilize a newer version of linux-headers so
that packages can make use of some of the features in the newer
kernels[1]? The bug open for this purpose[2] has not made any progress
in a long time.


1. http://bugs.gentoo.org/show_bug.cgi?id=290918
2. http://bugs.gentoo.org/show_bug.cgi?id=273358

-- 
~Nirbheek Chauhan

Gentoo GNOME+Mozilla Team

Re: [gentoo-dev] 2.6.31 stable plans

[Robert Bradbury]

[-- Attachment #1: Type: text/plain, Size: 431 bytes --]

There was discussion on /. today about there being a potential bug which
allows users to obtain root privileges.  Apparently its been fixed in BSD
but may still be a problem in RedHat distributions.  It is supposed to be
fixed in the kernel but only as of 2.6.32.

Is the fix being back-ported to 2.6.31 or should people plan/attempt to run
the kernel directly from kernel.org sources before they make it into the
Gentoo releases?

[-- Attachment #2: Type: text/html, Size: 484 bytes --]

Re: [gentoo-dev] 2.6.31 stable plans

[Robert Buchholz]

[-- Attachment #1: Type: text/plain, Size: 1351 bytes --]

On Thursday 05 November 2009, Robert Bradbury wrote:
> There was discussion on /. today about there being a potential bug
> which allows users to obtain root privileges.  Apparently its been
> fixed in BSD but may still be a problem in RedHat distributions.  It
> is supposed to be fixed in the kernel but only as of 2.6.32.
>
> Is the fix being back-ported to 2.6.31 or should people plan/attempt
> to run the kernel directly from kernel.org sources before they make
> it into the Gentoo releases?

I am not part of the kernel maintainers, but from what I see stabling a 
2.6.31 release usually means stabling the latest released patch. I 
assume Linux stable maintainers (upstream) will incorporate the NULL 
dereference patch into an upcoming release (2.6.31.6?).

As far as exploitability is concerned, in default configurations of 
gentoo-, vanilla- and hardened-sources this bug cannot be exploited to 
escalate privileges beyond a kernel panic.

The security team is tracking the vulnerability in this bug:
https://bugs.gentoo.org/show_bug.cgi?id=291904

We have recently extended our team with Björn (asym) who will be working 
closer with our kernel maintainers and improve developer (and user!) 
tools to keep systems secure. But I won't spoil the fun of explaining 
that in detail and leave it to him.


Robert

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [gentoo-dev] 2.6.31 stable plans

[Rémi Cardona]

Le 05/11/2009 00:15, Nirbheek Chauhan a écrit :
> Are there any plans to stabilize a newer version of linux-headers so
> that packages can make use of some of the features in the newer
> kernels[1]? The bug open for this purpose[2] has not made any progress
> in a long time.

Ditto, 2.6.32 will have new features for X users and I'd like to have it 
keyworded and stabilized at the same time as gentoo-sources.

Is that doable? Are there any specific reasons why both aren't bumped at 
the same time? Man power issues? Lack of cookies/beer/ponies?

Cheers :)

Rémi

Re: [gentoo-dev] 2.6.31 stable plans

[Graham Murray]

Rémi Cardona <remi@gentoo.org> writes:

> Ditto, 2.6.32 will have new features for X users and I'd like to have
> it keyworded and stabilized at the same time as gentoo-sources.
>
> Is that doable? Are there any specific reasons why both aren't bumped
> at the same time? Man power issues? Lack of cookies/beer/ponies?

Not just stabilising at the same time, it would also be nice if
linux-headers was put into ~arch at the same time as the corresponding
gentoo-sources. Even though the of stabilising 2.6.31 has been proposed,
linux-headers-2.6.31 is still not in the tree. Ideally, I think it would
be nice if the corresponding linux-headers were put into tree, but
packaged masked, when the -rc vanilla-sources are put into ~arch, but
that is probably asking too much.

Re: [gentoo-dev] 2.6.31 stable plans

[Samuli Suominen]

Graham Murray wrote:
> Rémi Cardona <remi@gentoo.org> writes:
> 
>> Ditto, 2.6.32 will have new features for X users and I'd like to have
>> it keyworded and stabilized at the same time as gentoo-sources.
>>
>> Is that doable? Are there any specific reasons why both aren't bumped
>> at the same time? Man power issues? Lack of cookies/beer/ponies?
> 
> Not just stabilising at the same time, it would also be nice if
> linux-headers was put into ~arch at the same time as the corresponding
> gentoo-sources. Even though the of stabilising 2.6.31 has been proposed,
> linux-headers-2.6.31 is still not in the tree. Ideally, I think it would
> be nice if the corresponding linux-headers were put into tree, but
> packaged masked, when the -rc vanilla-sources are put into ~arch, but
> that is probably asking too much.
> 

There's no real need for linux-headers and running kernel to be same
version, but yes, it would be nice.