From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pjotr Prins Subject: Security warnings (was Re: glibc update) Date: Thu, 18 Feb 2016 07:45:32 +0100 Message-ID: <20160218064532.GA9351@thebird.nl> References: <20160216202010.GA21380@jasmine> <20160217161419.GB1666@jasmine> <20160217162833.GA28579@novena-choice-citizen.lan> <497868EA-C201-41A5-BA96-73A7CBD21454@famulari.name> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:39859) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aWIMF-000547-RV for guix-devel@gnu.org; Thu, 18 Feb 2016 01:46:36 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aWIMC-0001Qf-Ko for guix-devel@gnu.org; Thu, 18 Feb 2016 01:46:35 -0500 Received: from mail.thebird.nl ([95.154.246.10]:57532) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aWIMC-0001QZ-F1 for guix-devel@gnu.org; Thu, 18 Feb 2016 01:46:32 -0500 Content-Disposition: inline In-Reply-To: <497868EA-C201-41A5-BA96-73A7CBD21454@famulari.name> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Leo Famulari Cc: guix-devel@gnu.org Someone noted that you can run a compromised glibc for a long time on Guix without realizing. How expensive would it be that every time you run Guix it would check for compromised versions and issue a warning like this: WARNING: version x.x of package name installed on your system has security concerns, please see URL and update the package to y.y or later. In the URL we give a fuller description and a list of packages that may need to be updated. Very long in the case of glibc. Pj. On Wed, Feb 17, 2016 at 01:27:22PM -0500, Leo Famulari wrote: > No, it doesn't graft. And it produces the same "version" of glibc, but with a patch applied for CVE-2015-7547. > > Well, you would make sure you cherry-pick the right hash. I can't confirm that from my phone. > > > -------- Original Message -------- > From: Jookia <166291@gmail.com> > Sent: February 17, 2016 11:28:33 AM EST > To: Leo Famulari > Cc: guix-devel@gnu.org > Subject: Re: glibc update > > On Wed, Feb 17, 2016 at 11:14:19AM -0500, Leo Famulari wrote: > > I tried this. The resulting process downloaded the bootstrap binaries > > and appeared to rebuild *everything*. I haven't had time to figure out > > what actually got rebuilt and if anything is still using the vulnerable > > glibc. > > This doesn't graft does it? It'd just bump glibc's version. > > --