Hi!

There was an embargo for attr and acl due to some security issues. I had
early access and reviewed the changes, which looked like they would make
the code Linux-only. I mentioned this on a code review in some commits,
but I'm assuming it got lost in the GitHub maze.

The embargo was lifted today, and I briefly looked at trying to make them
build on the Hurd for Debian, but was running out of time, so decided to
upload to Debian as is and look into this with a subsequent revision.

I'm not entirely sure this can be worked around properly from within
attr and acl, w/o proper setxattrat/getxattrat/listxattrat/removexattrat
support from the Hurd and glibc though. And anything else might just make
them build but carry the security issues.

I assume that if we had *xattrat functions the O_PATH problem would also
go away as that's (AFAIR) only in the compat code. The fallback code
when *xattrat functions are not supported is also Linux-only and thus
non-functional as that relies on /proc/self/fd/<n>.

I don't think I have the bandwidth to do the upstream Hurd/glibc part of
this, so if someone is looking for a project, that would be great! What I
can certainly do is try to workaround this to get the two Debian packages
building and working again (including security holes and all :/ ).

Thanks,
Guillem

Reply via email to