Your message dated Sat, 26 Jul 2008 21:32:05 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#491791: fixed in manpages 3.05-1
has caused the Debian Bug report #491791,
regarding manpages-dev: new O_EXCL warning is incorrect
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
491791: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=491791
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: manpages-dev
Version: 3.03-1
Severity: normal
In recent versions of manpages-dev, the warning about O_EXCL and NFS
reads in part:
O_EXCL is not supported on NFSv2 or on Linux before kernel 2.6; it is
supported on Linux 2.6 and later, with NFSv3 or later.
This is false. Linux 2.4.31 does support O_EXCL [0], correctly, it
appears. The same code appears to be present in Linux 2.4.0.
Additionally, I cannot honestly believe that something as important as
O_EXCL (which is required for avoiding root security holes) doesn't
actually work at all with 2.4 kernels[1]. It may not work in conjunction
with NFS; that's fine, and that should be documented. But the text
should not lead people to believe that O_EXCL only works with Linux 2.6,
when in fact that's not the case.
It might be useful to also explain whether NFS O_EXCL is broken with
regard to symlink attacks, as well as locking.
[0] http://lxr.linux.no/linux-old+v2.4.31/fs/namei.c#L1072
[1] If this is actually the case, then every program that creates an
O_EXCL file as root is vulnerable to symlink attacks. Yay for
overwriting /sbin/init!
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.26-trunk-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages manpages-dev depends on:
ii manpages 3.03-1 Manual pages about using a GNU/Lin
manpages-dev recommends no packages.
Versions of packages manpages-dev suggests:
ii man-db [man-browser] 2.5.2-2 on-line manual pager
-- no debconf information
--
brian m. carlson / brian with sandals: Houston, Texas, US
+1 713 440 7475 | http://crustytoothpaste.ath.cx/~bmc | My opinion only
troff on top of XML: http://crustytoothpaste.ath.cx/~bmc/code/thwack
OpenPGP: RSA v4 4096b 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
Source: manpages
Source-Version: 3.05-1
We believe that the bug you reported is fixed in the latest version of
manpages, which is due to be installed in the Debian FTP archive:
manpages-dev_3.05-1_all.deb
to pool/main/m/manpages/manpages-dev_3.05-1_all.deb
manpages_3.05-1.diff.gz
to pool/main/m/manpages/manpages_3.05-1.diff.gz
manpages_3.05-1.dsc
to pool/main/m/manpages/manpages_3.05-1.dsc
manpages_3.05-1_all.deb
to pool/main/m/manpages/manpages_3.05-1_all.deb
manpages_3.05.orig.tar.gz
to pool/main/m/manpages/manpages_3.05.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Joey Schulze <[EMAIL PROTECTED]> (supplier of updated manpages package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sat, 26 Jul 2008 23:01:11 +0200
Source: manpages
Binary: manpages manpages-dev
Architecture: source all
Version: 3.05-1
Distribution: unstable
Urgency: low
Maintainer: Martin Schulze <[EMAIL PROTECTED]>
Changed-By: Joey Schulze <[EMAIL PROTECTED]>
Description:
manpages - Manual pages about using a GNU/Linux system
manpages-dev - Manual pages about using GNU/Linux for development
Closes: 491791
Changes:
manpages (3.05-1) unstable; urgency=low
.
* New upstream version
. Remove ambiguity in description of support for O_EXCL on NFS in
open(2) (closes: Bug#491791)
Checksums-Sha1:
a3661cfd5c31b250e7894efa348dec7522a9beb9 964 manpages_3.05-1.dsc
991fee8a36c1f7d08f9a3802b36d72e02449ecf0 1401013 manpages_3.05.orig.tar.gz
d35c620b1f7af065eb1abc5192dc6d6109d70ab7 46567 manpages_3.05-1.diff.gz
bd06f892ab1237588a225241eadb76709b68e58a 615596 manpages_3.05-1_all.deb
cea3ffa2c038e1343806bdd58cfdb1cc13343433 1433366 manpages-dev_3.05-1_all.deb
Checksums-Sha256:
a51904a1c58a3408bc4efc57db328563b5fa3f38219109ef66a719af02d516d8 964
manpages_3.05-1.dsc
e64c457e6957f8e9488151638bd8172b3f92554bcc5af6fd7b4204698b4b4578 1401013
manpages_3.05.orig.tar.gz
5feda8c6c89b22d99ff3092de61620d28e6163ab34897a3fbe1cfc68822556a9 46567
manpages_3.05-1.diff.gz
aeda742952b3119d4577ac05fe56dcd18e7cd3543608a975da64757d085e321c 615596
manpages_3.05-1_all.deb
1b07287845c42aeacff11b6e6aad68fce00f80ba5b6855f849c1daf9732896b4 1433366
manpages-dev_3.05-1_all.deb
Files:
c8441eaa2bc0b9b68b0c99fb7f108183 964 doc important manpages_3.05-1.dsc
10d66a884c1d26b4e6c7c17494eb73cb 1401013 doc important
manpages_3.05.orig.tar.gz
55c0e394156dace3f706aa13aa4be192 46567 doc important manpages_3.05-1.diff.gz
a2cc7b9a0f2043ef4b4e27d299cf7e5a 615596 doc important manpages_3.05-1_all.deb
be1ff313b4c9905eff75f1c411de0ab6 1433366 doc optional
manpages-dev_3.05-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFIi5RIW5ql+IAeqTIRAkUWAJ96p+Ax7A/CY2cJIj/yzvVqNoGQ9QCffvP1
TV2UvkK9zb6G4A3y4aGtxog=
=h4fj
-----END PGP SIGNATURE-----
--- End Message ---
