Hi Bill, On Mon, Nov 20, 2006 at 07:13:14PM +0100, [EMAIL PROTECTED] wrote: > On Thu, Sep 28, 2006 at 02:31:19PM -0700, Steve Langasek wrote: > > # Automatically generated email from bts, devscripts version 2.9.21 > > severity 389934 important
> I don't see how you reached this conclusion. Users should be able > to rebuild packages without introducing security holes. Users should > be allowed to have users writable /buildd directory since it is > not a FHS mandated location. Add to that the directory /buildd is only > due to the way the buildd are setup currently. This detail of buildd configuration is one that isn't likely to change soon, so I don't think there's any real risk of these problems becoming exploitable as a result of rebuilds in stable. Users who have /buildd directories writable by untrusted users: possible, but fairly unlikely and obviously not a problem by default. Rebuilds in user home directories: this vector requires that a local rebuild of a package be done in the home directory of an untrusted user and then installed, or done in the home directory of a trusted user and then distributed to a system where a user of the same name exists and is untrusted. While plausible, this is also improbable. So my own opinion is that this class of bug should not be RC, at least when the embedded rpath doesn't lie in an obviously user-writable space such as /home or /tmp. If you feel strongly that these should be RC, please go ahead and re-upgrade them. But you may also want to look at <[EMAIL PROTECTED]>, posted to debian-release by a member of the security team. Thanks, -- Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. [EMAIL PROTECTED] http://www.debian.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
