Re: Security policy oversight needed?

2009-11-20 Thread James Morris
On Fri, 20 Nov 2009, Simo Sorce wrote: > > I agree, this needs protecting with a root password too. > > Jeff this is silly. > Shutdown in console by default is perfectly fine, otherwise the user can > simply push the power button. Access to the console does not imply access to the power button,

Re: PackageKit policy: background and plans

2009-11-20 Thread Stephen John Smoogen
On Fri, Nov 20, 2009 at 7:19 PM, James Morris wrote: > On Fri, 20 Nov 2009, Matthew Garrett wrote: > >> I know basically nobody who, on a generally single user system, >> explicitly switches to a console to log in as root and perform package >> installs there. > > This is how I started doing thing

Re: Local users get to play root?

2009-11-20 Thread James Morris
On Fri, 20 Nov 2009, Bill Nottingham wrote: > Benny Amorsen (benny+use...@amorsen.dk) said: > > > If there are pkgs which run daemons which are defaulting to ON when > > > installed or on next reboot - then we should be auditing those pkgs. > > > Last I checked we default to OFF and that should c

Re: PackageKit policy: background and plans

2009-11-20 Thread James Morris
On Fri, 20 Nov 2009, Bill Nottingham wrote: > > MAC policy can be updated without administrative privilege, breaking our > > MAC model in a fundamental way. > > I'm fairly sure that's wrong as well. Installation of another policy > does not override the current one. What about when the system i

Re: PackageKit policy: background and plans

2009-11-20 Thread James Morris
On Fri, 20 Nov 2009, Matthew Garrett wrote: > Actually, thinking about it, even this isn't sufficient. An attacker > could change the ctrl+alt+F* bindings and use them to pop up a > full-screen window that looks like the console. So you'd also need to > set up securetty to ensure that root can

Re: PackageKit policy: background and plans

2009-11-20 Thread Jeff Garzik
On 11/20/2009 09:19 PM, James Morris wrote: Are we moving toward a model where the user and the administrator are no longer really separated? Things seem to be regressing according to whatever use-case some desktop developer thinks is important at the time. Agreed. Speaking even more generall

Re: PackageKit policy: background and plans

2009-11-20 Thread James Morris
On Fri, 20 Nov 2009, Matthew Garrett wrote: > I know basically nobody who, on a generally single user system, > explicitly switches to a console to log in as root and perform package > installs there. This is how I started doing things in 1993, although I changed to sudo a few years back. > >

Re: Improve the way rpm decides what is newer

2009-11-20 Thread Adam Williamson
On Sat, 2009-11-21 at 00:58 +0100, Christian Iseli wrote: > Hi folks, > > I also got bitten by the "FC11 packages 'newer' than FC12" hickup, and > while going through the yum remove/add maneuver I pondered: > - is there ever a time when, while upgrading from Fedora n to Fedora > n+1 I would expe

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Chris Adams
Once upon a time, Kevin Kofler said: > 1. Needs GRUB hackery to support transparently. (For the DVD, Anaconda can > detect the architecture and install a kernel accordingly, but for a live CD, > we don't have any such support.) That would be SYSLINUX hackery, not GRUB hackery. The CD and DVD i

Re: Improve the way rpm decides what is newer

2009-11-20 Thread Julian Sikorski
W dniu 21.11.2009 02:02, Christian Iseli pisze: > On Sat, 21 Nov 2009 01:36:28 +0100, Kevin Kofler wrote: >> Including Vendor in comparisons is just FAIL. Packages often move >> from Fedora to RPM Fusion as legal problems are found or from RPM >> Fusion to Fedora as legal problems are cleared, ther

Re: Improve the way rpm decides what is newer

2009-11-20 Thread Christian Iseli
On Sat, 21 Nov 2009 01:36:28 +0100, Kevin Kofler wrote: > Including Vendor in comparisons is just FAIL. Packages often move > from Fedora to RPM Fusion as legal problems are found or from RPM > Fusion to Fedora as legal problems are cleared, there's no one vendor > which can have precedence. I don

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Kevin Kofler
Benny Amorsen wrote: > Kevin Kofler writes: > >> (and not really implementable for the live images) > > Why not? It should be reasonably easy to handle that in the boot loader. 1. Needs GRUB hackery to support transparently. (For the DVD, Anaconda can detect the architecture and install a ker

Re: abrt and bugzilla

2009-11-20 Thread Colin Walters
On Sat, Nov 21, 2009 at 12:32 AM, Kevin Kofler wrote: > Colin Walters wrote: >> You don't; the submitter of course should get a link to their crash >> report, and can perform the bugzilla promotion on their own if they >> have more to add. > > My experience is that fire&forget reporting is rarely

Re: Improve the way rpm decides what is newer

2009-11-20 Thread Kevin Kofler
Christian Iseli wrote: > A.Vendor <=> B.Vendor Including Vendor in comparisons is just FAIL. Packages often move from Fedora to RPM Fusion as legal problems are found or from RPM Fusion to Fedora as legal problems are cleared, there's no one vendor which can have precedence. On the other hand,

Re: abrt and bugzilla

2009-11-20 Thread Kevin Kofler
Colin Walters wrote: > You don't; the submitter of course should get a link to their crash > report, and can perform the bugzilla promotion on their own if they > have more to add. My experience is that fire&forget reporting is rarely useful, especially if it comes from an automated tool where us

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Kevin Kofler
Benny Amorsen wrote: > Kevin Kofler writes: > >> If we don't want to live in the past, we should go away from 32-bit, not >> from CDs. ;-) Doubling the download size for everyone is a bad solution. > > An extra kernel shouldn't be that big a problem. But it doesn't really solve the issue, as y

Improve the way rpm decides what is newer

2009-11-20 Thread Christian Iseli
Hi folks, I also got bitten by the "FC11 packages 'newer' than FC12" hickup, and while going through the yum remove/add maneuver I pondered: - is there ever a time when, while upgrading from Fedora n to Fedora n+1 I would expect a package .fcn to be kept instead of getting the .fcn+1 instance

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Benny Amorsen
Kevin Kofler writes: > If we don't want to live in the past, we should go away from 32-bit, not > from CDs. ;-) Doubling the download size for everyone is a bad solution. An extra kernel shouldn't be that big a problem. /Benny -- fedora-devel-list mailing list fedora-devel-list@redhat.com h

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Benny Amorsen
Kevin Kofler writes: > (and not really implementable for the live images) Why not? It should be reasonably easy to handle that in the boot loader. /Benny -- fedora-devel-list mailing list fedora-devel-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-devel-list

Re: abrt and bugzilla

2009-11-20 Thread Colin Walters
On Fri, Nov 20, 2009 at 10:52 PM, Kevin Kofler wrote: > Colin Walters wrote: >> In an anonymous crash system, there should be a "promote to bugzilla" >> link, where people could comment. > > And how would you track down the original submitter if you need further > information from him? You don't;

Re: abrt and bugzilla

2009-11-20 Thread Kevin Kofler
Colin Walters wrote: > In an anonymous crash system, there should be a "promote to bugzilla" > link, where people could comment. And how would you track down the original submitter if you need further information from him? Kevin Kofler -- fedora-devel-list mailing list fedora-devel-lis

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Kevin Kofler
drago01 wrote: > We could have to images on one disk and let the bootloader load the > appropriate one, but this would involve going away from CDs (which we > should do anyway, we can't live in the past forever and still claim to > be a leading edge distro) If we don't want to live in the past, we

Re: abrt and bugzilla

2009-11-20 Thread Colin Walters
On Fri, Nov 20, 2009 at 10:39 PM, Kevin Kofler wrote: > Christoph Wickert wrote: >> I disagree. As the maintainer, I need to be able to ask people for >> details, clarification, feedback etc. This is impossible for anonymous >> submissions and I doubt it will be possible with submissions that don'

Re: Old/compat package naming

2009-11-20 Thread Kevin Kofler
Bill Nottingham wrote: > Given the history of these, this sounds like way more work to change > than it's worth. (They'd certainly have to still provide 'glib2' > and 'gtk2' for many years in the future.) Well, given how few things still use gtk+ 1, it shouldn't be that hard to do now, as only th

Re: disallow broken push to updates?

2009-11-20 Thread Kevin Kofler
Thomas Janssen wrote: > If the special case is kde-plasma-smooth-tasks. It is not in updates > yet. The needed deps are in updates-testing. The problem is that the KDE 4.3.3 updates were edited while a push was underway and so got accidentally unpushed from testing. Kevin Kofler -- fed

Re: abrt and bugzilla

2009-11-20 Thread Kevin Kofler
Jiri Moskovcak wrote: > Yes, I'm planning to write another config backend for kwalet, but didn't > find any usable API reference so far :( This is the official API: http://api.kde.org/4.x-api/kdelibs-apidocs/kdeui/html/classKWallet_1_1Wallet.html This should also be usable through PyKDE4.

Re: abrt and bugzilla

2009-11-20 Thread Kevin Kofler
Christoph Wickert wrote: > I disagree. As the maintainer, I need to be able to ask people for > details, clarification, feedback etc. This is impossible for anonymous > submissions and I doubt it will be possible with submissions that don't > require an kind of authentication. +1 And in fact, we

Re: A silly question about our "FC" tag

2009-11-20 Thread Adam Williamson
On Fri, 2009-11-20 at 17:29 -0500, Alex Lancaster wrote: > I was in the AutoQA meeting at FUDCon Boston in January and there was > talk there then about deploying some AutoQA features "within 3-4 weeks", > but those archives only started in April. > > Were those test results that go to the mailin

Re: abrt and bugzilla

2009-11-20 Thread Kevin Kofler
Jiri Moskovcak wrote: > I must have lost it somewhere in my mailbox :-/ Thanks for reminding me, > seems like kwalet and g-k use the same dbus interface, will add support > for this soon. They both use D-Bus, but the interfaces are different, or at least were last I checked. Kevin Kofler

Re: A silly question about our "FC" tag

2009-11-20 Thread Alex Lancaster
On Thu, 2009-11-19 at 04:48 +0530, Rahul Sundaram wrote: [...] >> A lot of questions seem to be getting this answer but how close are >> we to AutoQA doing all this? Are we going to start running it and >> reporting bugs in Rawhide soon? > "AW" == Adam Williamson writes: AW> There's a week

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Ikem Krueger
>> The moblin stuff is a different use-case, primarily addressing the very low >> end of HW, which is competing with SmartPhones, the XOs and the like. > I understand your impressions but your claim that the Moblin spin isn't > targeted at netbooks is just plain wrong. There is just no way aroun

Re: Promoting i386 version over x86_64?

2009-11-20 Thread drago01
On Fri, Nov 20, 2009 at 11:21 PM, Kevin Kofler wrote: > Benny Amorsen wrote: >> If only the 32-bit version was smart enough to install a 64-bit kernel >> when appropriate, this would not be such a disaster. > > That's just a broken hackaround (and not really implementable for the live > images), t

Re: Can't seem to make tag

2009-11-20 Thread Alex Lancaster
> "NB" == Neal Becker writes: NB> Something seems strange here with libotf. I want to push 0.9.9-3 NB> for F12. I went into my F-12 subdir and did the usual make tag NB> build NB> ERROR: Tag libotf-0_9_9-3_fc12 has been already created. NB> OK, I bumped the tag. NB> cvs tag -c libotf-0_9

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Kevin Kofler
Benny Amorsen wrote: > If only the 32-bit version was smart enough to install a 64-bit kernel > when appropriate, this would not be such a disaster. That's just a broken hackaround (and not really implementable for the live images), the real solution is to get people to just use the 64-bit versio

Re: No fuse module in Koji builds?

2009-11-20 Thread Jeff Garzik
On 11/20/2009 10:07 AM, Dennis Gilmore wrote: On Wednesday 18 November 2009 11:25:15 am Richard W.M. Jones wrote: If they are or will be, will local non-root fuse mounts be permitted during builds? As far as I'm aware there are no security issues with doing this, although possibly there may be

Re: disallow broken push to updates?

2009-11-20 Thread Alex Lancaster
> "NB" == Neal Becker writes: NB> Wouldn't it be a good idea to disallow a push to updates that has NB> broken deps? It's a good idea, but as Josh Boyer says, it's quite tricky to actually implement. And there are so many other issues/fires to put out with getting each Fedora release, that

Re: Fedora rawhide rebuild in mock status 2009-11-18 x86_64

2009-11-20 Thread Matt Domsch
On Fri, Nov 20, 2009 at 09:20:54PM +0100, Robert Scheck wrote: > Hello Matt, > > On Wed, 18 Nov 2009, Matt Domsch wrote: > > mksh-39-1.fc12 (build/make) robert > > I tried to reproduce your build failure from your mass rebuild for mksh > > - > http://linux.dell.com/files/fedora/FixBuildRequire

Re: Security policy oversight needed?

2009-11-20 Thread Gene Czarcinski
On Friday 20 November 2009 13:30:12 Simo Sorce wrote: > On Fri, 2009-11-20 at 12:23 -0600, Bruno Wolff III wrote: > > On Fri, Nov 20, 2009 at 08:48:56 -0500, > > > > Simo Sorce wrote: > > > On Fri, 2009-11-20 at 03:42 -0500, Jeff Garzik wrote: > > > > On 11/20/2009 02:21 AM, Rudolf Kastl wrote:

Re: A silly question about our "FC" tag

2009-11-20 Thread Casey Dahlin
On 11/18/2009 09:43 AM, Mat Booth wrote: > 2009/11/18 Orcan Ogetbil : >> On Tue, Nov 17, 2009 at 10:18 AM, Jesse Keating wrote: >>> On Mon, 2009-11-16 at 17:11 -0600, Jason L Tibbitts III wrote: Actually not if done in conjunction with a release bump, such as we do with a mass rebuild. >>

Re: Fedora rawhide rebuild in mock status 2009-11-18 x86_64

2009-11-20 Thread Robert Scheck
Hello Matt, On Wed, 18 Nov 2009, Matt Domsch wrote: > mksh-39-1.fc12 (build/make) robert I tried to reproduce your build failure from your mass rebuild for mksh - http://linux.dell.com/files/fedora/FixBuildRequires/mock-results/x86_64/mksh-39-1.fc12.src.rpm/result/build.log - http://linux.de

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Bill McGonigle
On 11/19/2009 06:39 PM, Kevin Kofler wrote: > Yes, if the CPU has the lm (long mode) flag, it's a 64-bit-capable CPU and > using the 32-bit version is suboptimal. how can this be checked from within a web browser? Trusted Java applet? -Bill -- Bill McGonigle, Owner BFC Computing, LLC http://

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Bill McGonigle
On 11/20/2009 05:30 AM, Ralf Corsepius wrote: > As I tried to express several times before in this thread: Moblin is > addressing and entirely different use-case. > > Whether this use-case of interest in individual situations is a > different question - To some it might be interesting, to me, it

Re: PackageKit policy: background and plans

2009-11-20 Thread Conrad Meyer
On Friday 20 November 2009 05:52:44 am Gregory Maxwell wrote: > On Fri, Nov 20, 2009 at 12:26 AM, Conrad Meyer wrote: > > On the contrary. On the typical single user system, it's just as bad if > > an attacker can steal / delete / modify the user's files as it is if the > > attacker can modify /

Re: PackageKit policy: background and plans

2009-11-20 Thread Conrad Meyer
On Friday 20 November 2009 12:33:20 am James Morris wrote: > On Thu, 19 Nov 2009, Conrad Meyer wrote: > > > I think it's fair to say that having this happen as root would > > > generally be worse than it happening as an unprivileged user. For the > > > latter, the attacker would need to also then

FESCo meeting summary for 2009-11-20

2009-11-20 Thread Jon Stanley
=== #fedora-meeting: FESCo meeting 20091120 === Meeting started by jds2001 at 17:00:23 UTC. The full logs are available at http://meetbot.fedoraproject.org/fedora-meeting/2009-11-20/fesco.2009-11-20-17.00.log.html

Re: abrt and bugzilla

2009-11-20 Thread Adam Williamson
On Fri, 2009-11-20 at 09:39 -0700, Orion Poplawski wrote: > On 11/20/2009 05:01 AM, Paul Howarth wrote: > > FWIW, you could configure this for your own account by editing your > > bugzilla email preferences to not send you mail when the Cc: list changes. > > > > I did this long ago - I'm tempted t

Re: brp-python-bytecompile

2009-11-20 Thread David Malcolm
On Fri, 2009-11-20 at 09:53 -0700, Jerry James wrote: > I'm looking into the build failures Matt identified. With my shiny > new Rawhide VM, I'm seeing this output on a local build of a package > with no python sources: > > [ ... successful build messages ...] > + /usr/lib/rpm/brp-python-bytecomp

Re: Local users get to play root?

2009-11-20 Thread Adam Williamson
On Fri, 2009-11-20 at 10:50 -0500, Bill Nottingham wrote: > Benny Amorsen (benny+use...@amorsen.dk) said: > > > If there are pkgs which run daemons which are defaulting to ON when > > > installed or on next reboot - then we should be auditing those pkgs. > > > Last I checked we default to OFF and

Re: abrt and bugzilla

2009-11-20 Thread Adam Williamson
On Fri, 2009-11-20 at 11:24 +, Matthew Booth wrote: > Firstly, I'd like to say I think abrt is fantastic. Call what follows a > nit-pick. It's just a pretty in-your-face nit. > > After installing F12, after a short while I got presented with a couple > of SELinux errors. This is nothing unus

Re: Security policy oversight needed?

2009-11-20 Thread Simo Sorce
On Fri, 2009-11-20 at 12:23 -0600, Bruno Wolff III wrote: > On Fri, Nov 20, 2009 at 08:48:56 -0500, > Simo Sorce wrote: > > On Fri, 2009-11-20 at 03:42 -0500, Jeff Garzik wrote: > > > On 11/20/2009 02:21 AM, Rudolf Kastl wrote: > > > > there are also inconsistencies between gui clickery and shel

Re: Security policy oversight needed?

2009-11-20 Thread Bruno Wolff III
On Fri, Nov 20, 2009 at 08:48:56 -0500, Simo Sorce wrote: > On Fri, 2009-11-20 at 03:42 -0500, Jeff Garzik wrote: > > On 11/20/2009 02:21 AM, Rudolf Kastl wrote: > > > there are also inconsistencies between gui clickery and shell usage... > > > simple example: > > > > > > click "shutdown" in gno

Re: abrt and bugzilla

2009-11-20 Thread Tony Nelson
On 09-11-20 07:06:34, Jiri Moskovcak wrote: > On 11/20/2009 12:24 PM, Matthew Booth wrote: ... > > 5. Can abrt give me a list of submitted BZs so I can browse them if > > I want to? > > This is in our TODO: ABRT should find possible duplicates and offer > the reporter to browse them and manually

Re: PackageKit policy: background and plans

2009-11-20 Thread Seth Vidal
On Fri, 20 Nov 2009, Frank Ch. Eigler wrote: otaylor wrote: This actually is one of the big advantages of PackageKit - because the installation is being done by a daemon rather than a process running in your session, if the X session dies during package installation, you won't be left with

rawhide report: 20091120 changes

2009-11-20 Thread Rawhide Report
Compose started at Fri Nov 20 08:15:09 UTC 2009 New package fvkbd Free Virtual Keyboard New package gdouros-alexander-fonts A Greek typeface inspired by Alexander Wilson New package gdouros-analecta-fonts An ecclesiastic scripts font New package hunspell-ht Haitian

Re: PackageKit policy: background and plans

2009-11-20 Thread Seth Vidal
On Fri, 20 Nov 2009, Owen Taylor wrote: On Fri, 2009-11-20 at 11:50 -0430, Robert Marcano wrote: On 11/20/2009 10:04 AM, Matthew Garrett wrote: I know basically nobody who, on a generally single user system, explicitly switches to a console to log in as root and perform package installs ther

Re: Old/compat package naming

2009-11-20 Thread Karsten Hopp
Am 20.11.2009 17:34, schrieb Lubomir Rintel: Hi, automake1.11-2.fc11 automake17 1.7.9-12 What's wrong with this ? automake-1.11 is the new, current version, automake1{4,5,6,7} are the older ones. Karsten -- fedora-devel-list mailing list fedora-devel-list@redhat.com https:/

Re: PackageKit policy: background and plans

2009-11-20 Thread Frank Ch. Eigler
otaylor wrote: > This actually is one of the big advantages of PackageKit - because the > installation is being done by a daemon rather than a process running in > your session, if the X session dies during package installation, you > won't be left with a half-completed transaction. To what exte

brp-python-bytecompile

2009-11-20 Thread Jerry James
I'm looking into the build failures Matt identified. With my shiny new Rawhide VM, I'm seeing this output on a local build of a package with no python sources: [ ... successful build messages ...] + /usr/lib/rpm/brp-python-bytecompile Bytecompiling .py files below [BUILDROOT]/usr/lib*/python*/ us

Re: PackageKit policy: background and plans

2009-11-20 Thread Owen Taylor
On Fri, 2009-11-20 at 11:50 -0430, Robert Marcano wrote: > On 11/20/2009 10:04 AM, Matthew Garrett wrote: > > I know basically nobody who, on a generally single user system, > > explicitly switches to a console to log in as root and perform package > > installs there. If you're not doing that then

Re: abrt and bugzilla

2009-11-20 Thread Orion Poplawski
On 11/20/2009 05:01 AM, Paul Howarth wrote: FWIW, you could configure this for your own account by editing your bugzilla email preferences to not send you mail when the Cc: list changes. I did this long ago - I'm tempted to say it should be the default. -- Orion Poplawski Technical Manager

Re: Old/compat package naming

2009-11-20 Thread Bill Nottingham
Lubomir Rintel (lkund...@v3.sk) said: > glib1:1.2.10-32.fc11 > glib2 2.20.5-1.fc11 > > gtk+1:1.2.10-68.fc11 > gtk22.16.6-2.fc11 Given the history of these, this sounds like way more work to change than it's worth. (They'd certainly ha

Re: abrt and bugzilla

2009-11-20 Thread Orion Poplawski
On 11/20/2009 04:29 AM, Neal Becker wrote: I can't seem to get abrt to work at all. I suspect it's stuck on trying to get bz username password. I suspect it doesn't work correctly with kde. Yeah, gnome-keyring and KDE don't play together nicely at times. Try removing ~/.gnome2/keyrings and

Old/compat package naming

2009-11-20 Thread Lubomir Rintel
Hi, Alexander pointed out that I was suggesting a wrong name for Saxon 9 package [1]. In fact there's a couple of packages in repositories now that violate the naming policy [2] in the very same way. Apart from wondering what does Devrim think about renaming the existing saxon package, I'm wonderi

Re: PackageKit policy: background and plans

2009-11-20 Thread Robert Marcano
On 11/20/2009 10:04 AM, Matthew Garrett wrote: I know basically nobody who, on a generally single user system, explicitly switches to a console to log in as root and perform package installs there. If you're not doing that then the issue is basically moot - a user-level compromise will become a r

Re: PackageKit policy: background and plans

2009-11-20 Thread Bill Nottingham
James Morris (jmor...@namei.org) said: > - The local session can now install any signed packages from the Fedora >repos: > > - I think this includes old versions of packages (correct?) Incorrect. > MAC policy can be updated without administrative privilege, breaking our > MAC model i

FYI: packageDB URL changes coming up

2009-11-20 Thread Toshio Kuratomi
This is a heads up for people using the PackageDB in scripts. The plan is to have the 0.5.x PackageDB deployed in infrastructure no later than Fedora 13 Alpha (currently penciled in as 2010-02-09). This release will include major changes in the URL structure and a few removals of unused methods.

Re: abrt and bugzilla

2009-11-20 Thread Christoph Wickert
Am Freitag, den 20.11.2009, 11:24 + schrieb Matthew Booth: > To get useful bug reports from the unwashed > masses we need anonymous submission, or at least submission which > doesn't require any kind of account creation or authentication. I disagree. As the maintainer, I need to be able to a

Re: Security policy oversight needed?

2009-11-20 Thread Bill Nottingham
Rudolf Kastl (che...@gmail.com) said: > there are also inconsistencies between gui clickery and shell usage... > simple example: > > click "shutdown" in gnome just does it in f12 > > issuesing shutdown -h now on the shell asks for root password ... id > really expect a system to show consistent

Re: Local users get to play root?

2009-11-20 Thread Bill Nottingham
Benny Amorsen (benny+use...@amorsen.dk) said: > > If there are pkgs which run daemons which are defaulting to ON when > > installed or on next reboot - then we should be auditing those pkgs. > > Last I checked we default to OFF and that should continue to be the > > case. > > Is there a blanket p

Re: PackageKit policy: background and plans

2009-11-20 Thread Matthew Garrett
On Fri, Nov 20, 2009 at 09:38:43AM -0500, Fulko Hew wrote: >I do! And I tell everyone else too, so they learn/understand the >difference >between 'god' and a 'mere mortal user' (ie. root and anyone else). Actually, thinking about it, even this isn't sufficient. An attacker could cha

Re: No fuse module in Koji builds?

2009-11-20 Thread Dennis Gilmore
On Wednesday 18 November 2009 11:25:15 am Richard W.M. Jones wrote: > A package I'm building has an (optional) test which does a local > non-root fuse mount in order to run some tests. In Koji this gives > the error: > > fuse: device not found, try 'modprobe fuse' first > > So I have a couple

Re: allow adding repos in preupdate?

2009-11-20 Thread Toshio Kuratomi
On Fri, Nov 20, 2009 at 06:46:59AM -0500, Neal Becker wrote: > I'd like to add my favorite repo. Possible? > I thought preupgrade already took whatever repos you have enabled in yum. Do you want it to have UI for selecting repositories? Or something else? -Toshio pgpxlKePkYGCm.pgp Description

Re: Question about tagging

2009-11-20 Thread Toshio Kuratomi
On Thu, Nov 19, 2009 at 08:50:06PM -0800, Jesse Keating wrote: > On Fri, 2009-11-20 at 00:50 +0100, Kevin Kofler wrote: > > > > And why can't all this be done with s/git/SVN/? All we really need apart > > from what CVS already provides is atomic commit IDs, to make the > > "maintainers would not

Re: PackageKit policy: background and plans

2009-11-20 Thread Fulko Hew
On Fri, Nov 20, 2009 at 9:34 AM, Matthew Garrett wrote: > On Fri, Nov 20, 2009 at 04:09:15PM +1100, James Morris wrote: > > > Many users limit their use of the root account to essential system > > maintenance, and run general purpose applications as a regular > > unprivileged user. > > I know bas

Re: abrt and bugzilla

2009-11-20 Thread Jiri Moskovcak
On 11/20/2009 03:28 PM, Neal Becker wrote: Jiri Moskovcak wrote: On 11/20/2009 01:15 PM, Jaroslav Reznik wrote: On Friday 20 November 2009 13:11:49 Jiri Moskovcak wrote: On 11/20/2009 01:08 PM, Neal Becker wrote: Jiri Moskovcak wrote: On 11/20/2009 12:54 PM, Neal Becker wrote: Jaroslav Rez

Re: PackageKit policy: background and plans

2009-11-20 Thread Matthew Garrett
On Fri, Nov 20, 2009 at 04:09:15PM +1100, James Morris wrote: > Many users limit their use of the root account to essential system > maintenance, and run general purpose applications as a regular > unprivileged user. I know basically nobody who, on a generally single user system, explicitly sw

Re: abrt and bugzilla

2009-11-20 Thread Neal Becker
Jiri Moskovcak wrote: > On 11/20/2009 01:15 PM, Jaroslav Reznik wrote: >> On Friday 20 November 2009 13:11:49 Jiri Moskovcak wrote: >>> On 11/20/2009 01:08 PM, Neal Becker wrote: Jiri Moskovcak wrote: > On 11/20/2009 12:54 PM, Neal Becker wrote: >> Jaroslav Reznik wrote: >>> On Fr

Re: F12: where did window properties go?

2009-11-20 Thread Pádraig Brady
Jesse Keating wrote: > You're making the assumption that the change was made to save space. It > wasn't. I can't find the original thread right now, but it's part of a > cleanup on configuration tools. Upstream felt it no longer necessary to > expose this Wow. Did they get any estimates on the

Re: A silly question about our "FC" tag

2009-11-20 Thread Toshio Kuratomi
On Thu, Nov 19, 2009 at 11:52:42PM -0500, Orcan Ogetbil wrote: > > It's a hack. It's Fedora-specific, so doesn't belong in RPM (or > > anything else). And RPM will no longer produce predictable versioning. > > > > My proposed hack's outcome is quite predictable. > I just faced this same attitude

Re: PackageKit policy: background and plans

2009-11-20 Thread Gregory Maxwell
On Fri, Nov 20, 2009 at 12:26 AM, Conrad Meyer wrote: > On the contrary. On the typical single user system, it's just as bad if an > attacker can steal / delete / modify the user's files as it is if the attacker > can modify / delete system files. Privilege escalation isn't needed to delete > ever

Re: Security policy oversight needed?

2009-11-20 Thread Simo Sorce
On Fri, 2009-11-20 at 03:42 -0500, Jeff Garzik wrote: > On 11/20/2009 02:21 AM, Rudolf Kastl wrote: > > there are also inconsistencies between gui clickery and shell usage... > > simple example: > > > > click "shutdown" in gnome just does it in f12 > > Yeah, you can do that in F11 as well :( > >

Re: abrt and bugzilla

2009-11-20 Thread Jiri Moskovcak
On 11/20/2009 12:29 PM, Neal Becker wrote: I can't seem to get abrt to work at all. I suspect it's stuck on trying to get bz username password. I suspect it doesn't work correctly with kde. What does it say? Jirka <>-- fedora-devel-list mailing list fedora-devel-list@redhat.com https://www.

Re: abrt and bugzilla

2009-11-20 Thread Simon Andrews
Neal Becker wrote: I can't seem to get abrt to work at all. I suspect it's stuck on trying to get bz username password. I suspect it doesn't work correctly with kde. Are you behind a proxy? We've found that ABRT doesn't pick up our proxy settings and therefore can't submit reports from behi

Re: disallow broken push to updates?

2009-11-20 Thread Thomas Janssen
2009/11/20 Neal Becker : > Wouldn't it be a good idea to disallow a push to updates that has broken > deps? If the special case is kde-plasma-smooth-tasks. It is not in updates yet. The needed deps are in updates-testing. -- LG Thomas Dubium sapientiae initium -- fedora-devel-list mailing lis

Re: disallow broken push to updates?

2009-11-20 Thread Josh Boyer
On Fri, Nov 20, 2009 at 07:26:27AM -0500, Neal Becker wrote: >Wouldn't it be a good idea to disallow a push to updates that has broken >deps? Yes, it would. It's been discussed numerous times on this list an others. Summary: Needs hard thinking and people actually working on it. Not trivial.

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Andrew Haley
Mike A. Harris wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > King InuYasha wrote: > >> Except, that could be false advertising. In most cases, where CPU >> computation is not used heavily, 64-bit is actually SLOWER than the >> 32-bit counterpart. Optimizations are narrowing the gap

disallow broken push to updates?

2009-11-20 Thread Neal Becker
Wouldn't it be a good idea to disallow a push to updates that has broken deps? -- fedora-devel-list mailing list fedora-devel-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-devel-list

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Mike A. Harris
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 King InuYasha wrote: > Except, that could be false advertising. In most cases, where CPU > computation is not used heavily, 64-bit is actually SLOWER than the > 32-bit counterpart. Optimizations are narrowing the gap, but it still > remains true. On

Re: abrt and bugzilla

2009-11-20 Thread Jiri Moskovcak
On 11/20/2009 01:15 PM, Jaroslav Reznik wrote: On Friday 20 November 2009 13:11:49 Jiri Moskovcak wrote: On 11/20/2009 01:08 PM, Neal Becker wrote: Jiri Moskovcak wrote: On 11/20/2009 12:54 PM, Neal Becker wrote: Jaroslav Reznik wrote: On Friday 20 November 2009 12:29:34 Neal Becker wrote:

Re: Local users get to play root?

2009-11-20 Thread Benny Amorsen
Seth Vidal writes: > If there are pkgs which run daemons which are defaulting to ON when > installed or on next reboot - then we should be auditing those pkgs. > Last I checked we default to OFF and that should continue to be the > case. Is there a blanket prohibition on daemons defaulting to ON

Re: abrt and bugzilla

2009-11-20 Thread Jaroslav Reznik
On Friday 20 November 2009 13:11:49 Jiri Moskovcak wrote: > On 11/20/2009 01:08 PM, Neal Becker wrote: > > Jiri Moskovcak wrote: > >> On 11/20/2009 12:54 PM, Neal Becker wrote: > >>> Jaroslav Reznik wrote: > On Friday 20 November 2009 12:29:34 Neal Becker wrote: > > I can't seem to get abr

Re: abrt and bugzilla

2009-11-20 Thread Jiri Moskovcak
On 11/20/2009 01:08 PM, Neal Becker wrote: Jiri Moskovcak wrote: On 11/20/2009 12:54 PM, Neal Becker wrote: Jaroslav Reznik wrote: On Friday 20 November 2009 12:29:34 Neal Becker wrote: I can't seem to get abrt to work at all. I suspect it's stuck on trying to get bz username password. I

Re: abrt and bugzilla

2009-11-20 Thread Jiri Moskovcak
On 11/20/2009 01:01 PM, Paul Howarth wrote: On 20/11/09 11:24, Matthew Booth wrote: Firstly, I'd like to say I think abrt is fantastic. Call what follows a nit-pick. It's just a pretty in-your-face nit. After installing F12, after a short while I got presented with a couple of SELinux errors. T

Re: abrt and bugzilla

2009-11-20 Thread Neal Becker
Jiri Moskovcak wrote: > On 11/20/2009 12:54 PM, Neal Becker wrote: >> Jaroslav Reznik wrote: >> >>> On Friday 20 November 2009 12:29:34 Neal Becker wrote: I can't seem to get abrt to work at all. I suspect it's stuck on trying to get bz username password. I suspect it doesn't work

Re: abrt and bugzilla

2009-11-20 Thread Jiri Moskovcak
On 11/20/2009 12:24 PM, Matthew Booth wrote: Firstly, I'd like to say I think abrt is fantastic. Call what follows a nit-pick. It's just a pretty in-your-face nit. After installing F12, after a short while I got presented with a couple of SELinux errors. This is nothing unusual in a new Fedora r

Re: allow adding repos in preupdate?

2009-11-20 Thread Rahul Sundaram
On 11/20/2009 05:16 PM, Neal Becker wrote: > I'd like to add my favorite repo. Possible? I assume you meant Preupgrade. File a RFE I suppose. Rahul -- fedora-devel-list mailing list fedora-devel-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-devel-list

Re: abrt and bugzilla

2009-11-20 Thread Paul Howarth
On 20/11/09 11:24, Matthew Booth wrote: Firstly, I'd like to say I think abrt is fantastic. Call what follows a nit-pick. It's just a pretty in-your-face nit. After installing F12, after a short while I got presented with a couple of SELinux errors. This is nothing unusual in a new Fedora releas

Re: abrt and bugzilla

2009-11-20 Thread Jiri Moskovcak
On 11/20/2009 12:54 PM, Neal Becker wrote: Jaroslav Reznik wrote: On Friday 20 November 2009 12:29:34 Neal Becker wrote: I can't seem to get abrt to work at all. I suspect it's stuck on trying to get bz username password. I suspect it doesn't work correctly with kde. > From what I know it

Re: Promoting i386 version over x86_64?

2009-11-20 Thread Roberto Ragusa
Kevin Kofler wrote: > Ikem Krueger wrote: >> "You're pc could be run faster, if you upgrade this operating system >> to the 64bit version of it. You can download them here if you like: >> [Link]" > > That gives very little incentive to fetch the correct version. Making the > optimistic assumption

Re: abrt and bugzilla

2009-11-20 Thread Neal Becker
Jaroslav Reznik wrote: > On Friday 20 November 2009 12:29:34 Neal Becker wrote: >> I can't seem to get abrt to work at all. I suspect it's stuck on trying >> to >> get bz username password. I suspect it doesn't work correctly with kde. >> > >>From what I know it works correctly in KDE, even we

  1   2   >