Re: [gentoo-kernel] What is the policy for a security fix for kernel?

[Mathieu SEGAUD <mathieu.segaud@regala.cx>]

Vous m'avez dit récemment :

> Hi,

hi,


> For example, bug 249729 (http://bugs.gentoo.org/show_bug.cgi?id=249729) is a
> security bug that affect a lot of versions (
> http://www.securityfocus.com/bid/32516/info).
> Also, i may be wrong... i don't think it is a very dangerous bug... but it
> is a security bug anyway.
>
> So, what the KernelTeam do in this case?
>
> First, genpatches and gentoo-sources have in cvs-trunk 2.6.25, 2.6.26,
> 2.6.27 and now is creating the structure for 2.6.28. But let focus on .25,
> .26 and .27 that are the stable kernel releases.
>
> For .27, the 2.6.27.8 stable review cycle is in process, so when it's
> released, KernelTeam just update genpatches to have 2.6.27.8 patch and
> release 2.6.26-r4? And ask for stabilization?
>
> For .26, backport to genpatches and release 2.6.26-r4?
> Same for .25, and release 2.6.25-r10?
> (Or if the patch just apply with no problems, just get it and put it in
> there.)

it applies cleanly on top of both trees, compiles, boots and runs cool.
However, this "fix" doesn't fix all the issues, it just avoids OOM to be
triggered, but, softlockups can still take out your mental sanity, and
most of it, any instance of X is hardlocked up (by unix sockets
starvation). I really don't know of any real benefit...

> The older versions, are not suported by genpatches anymore... but they
> should stay marked as stable, even with security bugs?

I don't know about it

> And what is the procedure for the sys-kernel/vanilla-sources ebuilds? Leave
> it as it is? Try to stabilize any new version? Take out any version or put ~
> back in them?

as far as I can see, vanilla-sources are just ebuilds providing "as-is"
_vanilla_ kernel trees. if there are new official vanilla versions,
there are provided thru new ebuilds. if no 2.6.26.x is released fixing
this ou that -- which is very likely -- no ebuild will be added.

-- 
Mathieu