On Tue, 31 May 2016 18:44:10 +0100, Mick wrote:

> > The operator user was not used by CoreOS, but existed because it
> > exists in the Gentoo Portage system from which CoreOS is derived.
> > <end/snippets>
> > 
> > Full read [1]. It kinda shows that CoreOS is derived from Gentoo
> > and not ChromeOS; at least when time to blame a security lapse
> > elsewhere....

ChromeOS is based on Gentoo, so if CoreOS is based no ChromeOS it is a
second generation Gentoo derivative.

> Does this mean we need to do anything to improve the security of our
> systems?

The report seems to be saying that the problem is caused by using the
Gentoo default config, which assumes a Gentoo environment. So  it's fine
on Gentoo. But it won't hurt to run glsa-check from time to time (my sync
script does it every time and mails me if there's a problem).


-- 
Neil Bothwick

Everything else being equal, fat people use more soap.