Patch 1 is useless: Files wtmp, btmp and lastlog are not created
anymore in base-files 14.2, and the function ensure_file_owner_mode is
not called anywhere. I would rather drop the function as a cleanup
measure.

Patch 3 is incomplete and therefore wrong: Using sha256sum alone will
not work unless there is a matching file with the sha256sums of old
files, which your patch misses completely. To do it "right", one would
have to recalculate those hashes on the old files using the new
function, but given that there is no real security gain in doing so,
I'm not going to change it at this point. (People do not replace their
working /etc/profile file by another file having the same md5sum as an
old version just for fun).

[ Did you really generate the patch without actually understanding how
  the code works? ]

Only patch 2 makes sense, I will apply it in 14.3, whenever that will
happen.

Thanks.

Reply via email to