From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.62) (envelope-from ) id 1HGDz2-0003HY-Rq for garchives@archives.gentoo.org; Sun, 11 Feb 2007 12:39:09 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.14.0/8.14.0) with SMTP id l1BCZiC0016180; Sun, 11 Feb 2007 12:35:44 GMT Received: from averell.tiscali.it (averell.tiscali.it [213.205.33.55]) by robin.gentoo.org (8.14.0/8.14.0) with ESMTP id l1BCZiX2016163 for ; Sun, 11 Feb 2007 12:35:44 GMT Received: from c1358217.kevquinn.com (84.223.98.78) by averell.tiscali.it (7.2.079) id 458977D00056B47A for gentoo-hardened@lists.gentoo.org; Sun, 11 Feb 2007 13:35:42 +0100 Date: Sun, 11 Feb 2007 13:38:25 +0100 From: "Kevin F. Quinn" To: gentoo-hardened@lists.gentoo.org Subject: Re: [gentoo-hardened] security updates Message-ID: <20070211133825.09a41e30@c1358217.kevquinn.com> In-Reply-To: <20070210160237.GB5317@swordfish.capgemini.hu> References: <20070210160237.GB5317@swordfish.capgemini.hu> X-Mailer: Sylpheed-Claws 2.5.6 (GTK+ 2.10.6; i686-pc-linux-gnu) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org Mime-Version: 1.0 Content-Type: multipart/signed; boundary="Sig_n9g08RjK69+tvrrF_y/Uccr"; protocol="application/pgp-signature"; micalg=PGP-SHA1 X-Archives-Salt: 843b05ef-df0d-4873-96dc-cf86d02e833b X-Archives-Hash: 3817b5a0c5bcfea2d9f8631c59b91dc7 --Sig_n9g08RjK69+tvrrF_y/Uccr Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable On Sat, 10 Feb 2007 17:02:38 +0100 Nagy Gabor Peter wrote: > Hi list, >=20 > I have a question: >=20 > Since I am new to gentoo, I don't know how security updates work. >=20 > I know Debian. In Debian if I have stable installed on a production > server, I get regular security fixes, often backported from the > current bleeding edge version, where upstream has fixed the bug to > the version that Debian stable contains. Where a security issue is identified in a package, all versions in the tree are either bumped (patched, backported or otherwise) or removed from the tree. > I have noticed that in gentoo there are many versions of a package > that are considered stable. Take glibc as an example, according to > http://packages.gentoo.org/search/?sstring=3Dglibc, on x86 there are 8 > versions available, all of them stable. Yep; that's normal. We don't force people to always go up to the latest version of a package. This is especially true for central packages like glibc, which users may well prefer not to upgrade apart from security fixes. If you're building a new system, you might as well use the latest (which is what you get unless you specifically ask for something different). > I have now two gentoo machines, one is going to be production, the > other is used to get me a little bit more familiar with the system. >=20 > On the playground machine I have 2006.1 installed, glibc 2.4-r3 > On the production machine I have 2006.0, switched to hardened profile, > and then recompile, there I have glibc 2.3.6-r5 >=20 > I see now that glibc 2.4-r3 should be upgraded to 2.4-r4 (by the way, > where can I check the differences (Changelog) between two gentoo > versions (like r3 and r4)?) >=20 > So my question: If someone finds a bug in glibc that gets corrected, > what does the gentoo maintainers do about it? Do they backport the fix > in all 8 versions? Or just in some of the versions and mark the not > fixed ones ~? For serious security issues, all versions, stable and ~, should get patched & bumped, or removed if they're not easily patched. For other bugs it depends on the severity of a bug. > Is there some mailinglist (like debian-security-announce) where such > security fixes are announced? See the gentoo-announce mailing list, where all GLSA (Gentoo Linux Security Advisories) are posted. > What is the reason that the hardened profile selects the 2.3.6 version > instead of the 2.4? I mean not in glibc's case only, but generally. Our toolchain modifications for >=3Dglibc-2.4 and gcc-4.1 aren't quite ready yet. I just have to resolve some significant test failures on x86, then it should be good to go. > Does libc 2.4 have troubles with ssp? Not really, however SSP has changed significantly from gcc-3 to gcc-4 - RedHat have re-implemented SSP and in the process changed its behaviour in significant ways. --=20 Kevin F. Quinn --Sig_n9g08RjK69+tvrrF_y/Uccr Content-Type: application/pgp-signature; name=signature.asc Content-Disposition: attachment; filename=signature.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFzw5B9G2S8dekcG0RAvNuAJ9nb6LFGABjb3mzylG9uxbaAkc1iACgms7f MoIRA+Qy9dW1wLQUr1kguXc= =Ml5a -----END PGP SIGNATURE----- --Sig_n9g08RjK69+tvrrF_y/Uccr-- -- gentoo-hardened@gentoo.org mailing list