On 01/10/2010 21:59:40, Jerry wrote: > On Fri, 1 Oct 2010 12:14:20 -0500 > Dan Nelson <dnel...@allantgroup.com> articulated: > >> You must have missed >> http://security.freebsd.org/advisories/FreeBSD-SA-10:08.bzip2.asc ; >> patches for 6, 7, and 8 are available there, and freebsd-update has >> fixed binaries if you use that. > > Never saw it. So I am assuming that simply using something like: > > csup -L2 -h cvsup.FreeBSD.org "/usr/src/share/examples/cvsup/standard-supfile" > > Then rebuild Kernel & World is not going to work. Is that correct?
Not correct. csup(1) /after/ the date that fixes are published will
obtain sources that contain the fixes on all affected and supported
branches, including 8-STABLE and 9-CURRENT which aren't covered by
freebsd-update(8). This will be documented in the security advisory,
where they list the revision numbers (both SVN and CVS) at which the
fixes were applied.
You don't need to /both/ apply patches and use csup -- csup already
contains the result of applying the patches. Patches are an alternative
to csup, but the intended audience there is typically people running
either heavily customized variants of the OS or installations with
severely limited bandwidth or restricted internet connectivity. The
majority of users should be using the standard update mechanisms -- csup
or freebsd-update.
Obviously, you will have to compile[*] and install the fixed software.
Going through a full buildworld cycle will certainly do that, but in
most cases you can achieve the required result by rebuilding and
reinstalling significantly smaller chunks of the system. Again,
procedures to do this should be described in the security advisory,
together with any other requirements (eg. that you would have to reboot
your system where there are significant changes to the kernel, or even
to ubiquitous bits like libc.so.)
Cheers,
Matthew
[*] Unless you're using freebsd-update, of course.
--
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
JID: matt...@infracaninophile.co.uk Kent, CT11 9PW
signature.asc
Description: OpenPGP digital signature
