[gentoo-kernel] What is the policy for a security fix for kernel?

["Bruno Buss" <bruno.buss@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1507 bytes --]

Hi,

For example, bug 249729 (http://bugs.gentoo.org/show_bug.cgi?id=249729) is a
security bug that affect a lot of versions (
http://www.securityfocus.com/bid/32516/info).
Also, i may be wrong... i don't think it is a very dangerous bug... but it
is a security bug anyway.

So, what the KernelTeam do in this case?

First, genpatches and gentoo-sources have in cvs-trunk 2.6.25, 2.6.26,
2.6.27 and now is creating the structure for 2.6.28. But let focus on .25,
.26 and .27 that are the stable kernel releases.

For .27, the 2.6.27.8 stable review cycle is in process, so when it's
released, KernelTeam just update genpatches to have 2.6.27.8 patch and
release 2.6.26-r4? And ask for stabilization?

For .26, backport to genpatches and release 2.6.26-r4?
Same for .25, and release 2.6.25-r10?
(Or if the patch just apply with no problems, just get it and put it in
there.)


The older versions, are not suported by genpatches anymore... but they
should stay marked as stable, even with security bugs?



And what is the procedure for the sys-kernel/vanilla-sources ebuilds? Leave
it as it is? Try to stabilize any new version? Take out any version or put ~
back in them?


Ty
-- 
Bruno C. Buss
http://magoobr.blogspot.com/
http://www.dcc.ufrj.br/~brunobuss/

Aluno do DCC - UFRJ - www.dcc.ufrj.br

if( ((*node)->valor) < (((*heap)[((*node)->gr)])->valor)) /* WTF?! */

"Throughout your life, advance daily, becoming more skillful than yesterday,
more skillful than today. This is never-ending." - Hagakure

[-- Attachment #2: Type: text/html, Size: 1994 bytes --]