Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Joey Hess
Manoj Srivastava wrote: > Policy can make it so that packages are not accepted into > Debian unless you hop through certain hoops. Like making sure the > upload has a signature. Or that it has an entry in the override > file. No, those have nothing to do with policy and are implemented so

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Manoj Srivastava
On Sun, 3 Aug 2003 22:30:52 -0400, Joey Hess <[EMAIL PROTECTED]> said: > Manoj Srivastava wrote: >> I note that later discussion tried to paint this whole process as >> getting people involved in auditing code, and not a mandatory >> requirement (ie, if you do not get a consensus then your packag

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Joey Hess
Manoj Srivastava wrote: > I note that later discussion tried to paint this whole process > as getting people involved in auditing code, and not a mandatory > requirement (ie, if you do not get a consensus then your package is > buggy) that was in the original proposal. Fundamentally you m

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Manoj Srivastava
On Sun, 3 Aug 2003 18:53:34 -0400, Joey Hess <[EMAIL PROTECTED]> said: > Manoj Srivastava wrote: >> I would be enthusiastically for a list like -legal, where people >> can go and ask for help to have packages audited, but not for >> people rolling up policy to beat people on the head to make it s

run-parts problem again

2003-08-03 Thread Martijn van Oosterhout
Way back when Russel Coker reported a problem with run-parts in woody (message-id <[EMAIL PROTECTED]>, 3 Jan 2003). We've been experiencing this problem quite regularly such that I've created a cron job to automatically kick them along. In any case, the above thread suggested the problem was fixed

Re: libraries being removed from the archive

2003-08-03 Thread Steve Langasek
On Mon, Aug 04, 2003 at 01:37:43AM +0200, Thomas Viehmann wrote: > Chris Cheney wrote: > ... > > for example libexif8 was removed by Christophe Barbe and replaced by > > libexif9. Guess what that does... any package which depends on libexif8 > ... > > not be removed from the archive until no other

Re: libraries being removed from the archive

2003-08-03 Thread Thomas Viehmann
Chris Cheney wrote: ... > for example libexif8 was removed by Christophe Barbe and replaced by > libexif9. Guess what that does... any package which depends on libexif8 ... > not be removed from the archive until no other packages still depend on > it. Well, if it's uninstallable for a couple of

Re: Bug#203653: ITP: autoconf-archive -- The GNU Autoconf Macro Archive

2003-08-03 Thread Roger Leigh
Martin Godisch <[EMAIL PROTECTED]> writes: > Package: wnpp > Version: N/A; reported 2003-07-31 > Severity: wishlist > > * Package name: autoconf-archive > Version : 20030521 > Upstream Author : > * URL : http://www.gnu.org/software/ac-archive/ > * License : GPL

Re: setgid crontab

2003-08-03 Thread Russell Coker
On Mon, 4 Aug 2003 08:25, Steve Greenland wrote: > On 03-Aug-03, 11:37 (CDT), Joey Hess <[EMAIL PROTECTED]> wrote: > > (As a user, what I really want is a .crontab file in my home directory, > > so I can put it under revision control.) > > One potential problem (or issue) I see with this is automou

Re: libraries being removed from the archive

2003-08-03 Thread christophe barbe
Ok, sorry for being rude in my previous mail. I understand the general problem that you are facing with KDE and will try in the future to announce upcomming soname changes. Concerning the removal, I don't really see the point of not removing older libraries from unstable. Most of the time, rebui

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Joey Hess
Manoj Srivastava wrote: > I would be enthusiastically for a list like -legal, where > people can go and ask for help to have packages audited, but not for > people rolling up policy to beat people on the head to make it so. Perhaps your confusion stems from me using a non-normative "should

Re: setgid crontab

2003-08-03 Thread Steve Greenland
On 03-Aug-03, 11:37 (CDT), Joey Hess <[EMAIL PROTECTED]> wrote: > (As a user, what I really want is a .crontab file in my home directory, > so I can put it under revision control.) One potential problem (or issue) I see with this is automounted home directories. A file that was there while the us

Re: setgid crontab

2003-08-03 Thread Steve Greenland
On 03-Aug-03, 11:37 (CDT), Joey Hess <[EMAIL PROTECTED]> wrote: > > One possible gotcha is that if crontab(1) does any sanity checks of the > crontab files, cron could expect them to be pre-sanitised, and might > behave badly if an unsanitised file is put into place by a user. Crontab and cron c

Re: CUPS should be the default print service in Debian/Sarge

2003-08-03 Thread Joe Wreschnig
On Sun, 2003-08-03 at 01:44, Marc Wilson wrote: > On Sat, Aug 02, 2003 at 02:51:53AM -0500, Joe Wreschnig wrote: > > For the vast majority of situations, it's incredibly easier to configure, > > and usually more reliable about output, than lprng. > > Implying that there are circumstances where CUP

Re: libraries being removed from the archive

2003-08-03 Thread Chris Cheney
On Sun, Aug 03, 2003 at 05:31:37PM -0400, christophe barbe wrote: > You are kidding right? > > I have not removed an old library, I have uploaded a newer upstream with > a different soname. That's the way it works, a new library is uploaded, > then packages using it are rebuilt and when they are a

Re: libraries being removed from the archive

2003-08-03 Thread christophe barbe
You are kidding right? I have not removed an old library, I have uploaded a newer upstream with a different soname. That's the way it works, a new library is uploaded, then packages using it are rebuilt and when they are all ready they migrate in testing. As the gphoto2 maintainer, I don't remem

Re: libraries being removed from the archive

2003-08-03 Thread Chris Cheney
On Sun, Aug 03, 2003 at 03:55:41PM -0400, David Z Maze wrote: > Chris Cheney <[EMAIL PROTECTED]> writes: > > > IMHO we need to make an addition to policy stating that an old lib can > > not be removed from the archive until no other packages still depend on > > it. > > So say I maintain foo. The

Re: proposal: per-user temporary directories on by default?

2003-08-03 Thread Kevin Kreamer
Tollef Fog Heen <[EMAIL PROTECTED]> writes: > * Kevin Kreamer > [...] > > | [1] My solution as to how to get the path from libpam-tmpdir to > | pam-tmpdir-helper was to pass it on the command line. But, since > | anyone can run pam-tmpdir-helper, anyone can create any tmpdir they > | like anywher

Re: setgid crontab

2003-08-03 Thread Tollef Fog Heen
* Joey Hess | (As a user, what I really want is a .crontab file in my home directory, | so I can put it under revision control.) have a .crontab in your ~ with a line similar to @daily crontab $HOME/.crontab ? (Naturally, you'd have to get that crontab initially installed, though.) -- Tolle

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Manoj Srivastava
On Sun, 3 Aug 2003 13:24:13 -0400, Joey Hess <[EMAIL PROTECTED]> said: > Manoj Srivastava wrote: >> Not without a transition plan in the general case. And my point, >> which you have not addressed, was that most of your examples were >> not ones that mandated significant changes to the source or

Re: setgid crontab

2003-08-03 Thread Manoj Srivastava
On Sun, 3 Aug 2003 12:37:46 -0400, Joey Hess <[EMAIL PROTECTED]> said: > (As a user, what I really want is a .crontab file in my home > directory, so I can put it under revision control.) Umm, as a work around, I have ~/etc/crontab, and at one time had a cron job that tested the output

Re: libraries being removed from the archive

2003-08-03 Thread David Z Maze
Chris Cheney <[EMAIL PROTECTED]> writes: > IMHO we need to make an addition to policy stating that an old lib can > not be removed from the archive until no other packages still depend on > it. So say I maintain foo. The source package produces two binary packages, foo and libfoo1. Now, there's

Re: libraries being removed from the archive

2003-08-03 Thread Chris Cheney
On Sun, Aug 03, 2003 at 08:55:48AM +0200, Eduard Bloch wrote: > #include > * LapTop006 [Sun, Aug 03 2003, 03:13:57PM]: > > > > IMHO we need to make an addition to policy stating that an old lib can > > > not be removed from the archive until no other packages still depend on > > > it. > > How abo

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Joey Hess
Manoj Srivastava wrote: > I haven't objected to code reviews of packages; I objected to > gathering consensus through discussion; and making admission of new > packages incumbent on such consensus. Again, how is this different from the debian-legal mailing list? -- see shy jo, amazed at

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Joey Hess
Manoj Srivastava wrote: > Not without a transition plan in the general case. And my > point, which you have not addressed, was that most of your examples > were not ones that mandated significant changes to the source or > behavior of programs. > First, most of these alloowed people

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Manoj Srivastava
On Sun, 3 Aug 2003 00:16:59 -0400, Matt Zimmerman <[EMAIL PROTECTED]> said: > On Sun, Aug 03, 2003 at 10:57:51AM +0900, Oohara Yuuma wrote: >> I don't care if you mandate a prior peer view _request_ (not prior >> approval) > This is what was proposed, except that it was recommended rather > than

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Manoj Srivastava
On Sun, 3 Aug 2003 11:59:03 -0400, Joey Hess <[EMAIL PROTECTED]> said: > In certian cultures, including mine, gratutious repitions of ones > point is considered childish and rude and something most of us > outgrow by age 6. I would much rather you restricted your responses to the substa

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Manoj Srivastava
On Sat, 2 Aug 2003 22:17:16 -0400, Matt Zimmerman <[EMAIL PROTECTED]> said: > On Sat, Aug 02, 2003 at 08:14:15PM -0500, Manoj Srivastava wrote: >> Heh. You should look at what is in the current version: > Is that what you would say to the users who have angband installed > on Woody? I do not th

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Manoj Srivastava
On Sun, 3 Aug 2003 03:14:23 -0400, Matt Zimmerman <[EMAIL PROTECTED]> said: > On Sat, Aug 02, 2003 at 08:58:00PM -0500, Manoj Srivastava wrote: > This bug and others existed in your package for over four years (and > still exist in stable today). We might still not know about it if > you had no

Re: proposal: per-user temporary directories on by default?

2003-08-03 Thread Tollef Fog Heen
* Kevin Kreamer | Tollef Fog Heen <[EMAIL PROTECTED]> writes: | > ATM, TMPDIR is defined using #define in libpam-tmpdir's source. | > Patches for having that as a run-time configuration are accepted. | | I recently posted to debian-devel a patch to do this (not sure | whether you saw it or not).

Re: debconf 2005 in Vienna, Austria

2003-08-03 Thread Joel Baker
On Sun, Aug 03, 2003 at 08:05:01AM +0200, Matthias Urlichs wrote: > Hi, Joel Baker wrote: > > > Diesel locomotives are a giant diesel generator hooked up to electric > > traction motors, running through the switchbox at something like 600v > > (I haven't read the specs in a while, this might be of

Re: setgid crontab

2003-08-03 Thread Joey Hess
Steve Greenland wrote: > Apropos of the recent setuid/setgid thread, and also being prodded by > Stephen Frost, I've changed crontab to be setgid 'cron' rather than > setuid 'root'. Beyond the coding (which is mostly removing setuid() > calls), this involves the following changes: > > add system g

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Joey Hess
Matt Zimmerman wrote: > There are other solutions, including group membership, but it doesn't > matter, because that is not what I am talking about. The fact is, many > programs run with privileges that they do NOT require in order to function > acceptably, or even fully, and I want to promote dis

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Joey Hess
Manoj Srivastava wrote: > Packaging informatoin, not program behaviour affected by > this. Packaging details are determined by developers, and can be > easily changed. > > Packaging informatoin, not program behaviour affected by > this. Packaging details are determined by developer

Re: setgid crontab

2003-08-03 Thread Steve Greenland
On 02-Aug-03, 23:36 (CDT), Matt Zimmerman <[EMAIL PROTECTED]> wrote: > So: open, fstat, stat, compare fstat.st_ino to stat.st_ino, check > fstat.st_uid. O_EXCL should also be used when writing to the directory. That introduces a (possibly minor) race condition: if the user runs crontab to replac

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Steve Kemp
On Sun, Aug 03, 2003 at 03:14:23AM -0400, Matt Zimmerman wrote: > Surely two people would be an improvement over the current situation, where > there is no review at all. Our demonstration has shown how one person can > discover some common flaws with a relatively brief review. *Exactly*. Wel

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Steve Kemp
On Sat, Aug 02, 2003 at 08:58:00PM -0500, Manoj Srivastava wrote: > > Given the last review of a setgid program, I wonder if two > people are enough. The mistake was simple, human, and undesrtandable, > but the review does not in fact talk about any flaws in the current > version of angba

Re: debconf 2005 in Vienna, Austria

2003-08-03 Thread Andreas Metzler
Christian Perrier <[EMAIL PROTECTED]> wrote: > Quoting Riku Voipio ([EMAIL PROTECTED]): >> Trains (atleast the newer ones in finland) have electric sockets, > > This is still quite rare. For instance, in french trains (TGV and > "Teoz", formerly known as "Corail"ie Intercity trains), electri

Re: debconf 2005 in Vienna, Austria

2003-08-03 Thread Andreas Barth
* Matthias Urlichs ([EMAIL PROTECTED]) [030803 08:35]: > A few years ago in Germany there was a huge stink raised by the > environmentalists (rightly so, IMHO) because the mid-range trains running > on nonelectrified trains sometimes ran with two Diesel locomotives so that > the coffee machines in

Re: mutt co-maintainer badly needed

2003-08-03 Thread Aaron Lehmann
On Sun, Aug 03, 2003 at 04:37:53AM +0200, Marco d'Itri wrote: > - eventually packaging the mutt CVS tree, as the author has not made any > new snapshots in the last months He doesn't seem to be committing much, either. A patch I sent was repeatedly ignored.

Re: libraries being removed from the archive

2003-08-03 Thread Eduard Bloch
#include * LapTop006 [Sun, Aug 03 2003, 03:13:57PM]: > > IMHO we need to make an addition to policy stating that an old lib can > > not be removed from the archive until no other packages still depend on > > it. > How about old libraries can not be removed until either no packages > depend on it

Re: setuid/setgid binaries contained in the Debian repository.

2003-08-03 Thread Matt Zimmerman
On Sat, Aug 02, 2003 at 08:58:00PM -0500, Manoj Srivastava wrote: > Given the last review of a setgid program, I wonder if two > people are enough. Surely two people would be an improvement over the current situation, where there is no review at all. Our demonstration has shown how one pe

Re: CUPS should be the default print service in Debian/Sarge

2003-08-03 Thread Marc Wilson
On Sat, Aug 02, 2003 at 02:51:53AM -0500, Joe Wreschnig wrote: > For the vast majority of situations, it's incredibly easier to configure, > and usually more reliable about output, than lprng. Implying that there are circumstances where CUPS will produce valid output, and lprng will not? I'm inte

Re: debconf 2005 in Vienna, Austria

2003-08-03 Thread Matthias Urlichs
Hi, Joel Baker wrote: > Diesel locomotives are a giant diesel generator hooked up to electric > traction motors, running through the switchbox at something like 600v > (I haven't read the specs in a while, this might be off - but it's high > enough to warrant being really careful around). Don't ev

Re: libraries being removed from the archive

2003-08-03 Thread LapTop006
On Sat, Aug 02, 2003 at 09:32:37PM -0500, Chris Cheney arranged a set of bits into the following: > Today I was reminded of something that causes apps not to migrate into > sarge. When maintainers remove old libraries from the archive! Today > for example libexif8 was removed by Christophe Barbe

Re: debconf 2005 in Vienna, Austria

2003-08-03 Thread Martin List-Petersen
On Sat, 2003-08-02 at 21:31, Thomas Viehmann wrote: > Sven Luther wrote: > > You are aware that due to the high heat we had in france this early > > summer, lot of train going to the south of france did blew a fuse or > > something because of the climatisation or something such, and thus where > >