Re: Linux kernel hardening - link restrictions

2012-03-08 Thread Ben Hutchings
On Thu, 2012-03-08 at 12:19 +0100, Vincent Lefevre wrote: > Hi, > > On 2012-03-02 05:11:58 +, Ben Hutchings wrote: > > I'm therefore intending to warn about this with the following NEWS > > entry in the linux-image metapackages: > > > > Index: debian/linux-image.NEWS > > =

Re: Linux kernel hardening - link restrictions

2012-03-08 Thread Vincent Lefevre
Hi, On 2012-03-02 05:11:58 +, Ben Hutchings wrote: > I'm therefore intending to warn about this with the following NEWS > entry in the linux-image metapackages: > > Index: debian/linux-image.NEWS > === > --- debian/linux-image.NE

Re: Linux kernel hardening - link restrictions

2012-03-03 Thread Ansgar Burchardt
Ben Hutchings writes: >> On Fri, Mar 02, 2012 at 05:11:58AM +, Ben Hutchings wrote: >> > The longstanding link restriction patches were recently accepted by >> > Andrew Morton and are likely to end up in Linux 3.4. I've applied >> > these to src:linux-2.6 in svn and they should end up in the

Re: Linux kernel hardening - link restrictions

2012-03-03 Thread Adam D. Barratt
On 02.03.2012 10:47, Holger Levsen wrote: On Freitag, 2. März 2012, Kees Cook wrote: > + * The new kernel version includes security restrictions on links, > +These restrictions may cause some legitimate programs to fail. > +In particular, if the 'at' package is installed, you should e

Re: Linux kernel hardening - link restrictions

2012-03-03 Thread Ben Hutchings
On Fri, 2012-03-02 at 07:43 +, Lars Wirzenius wrote: > On Fri, Mar 02, 2012 at 05:11:58AM +, Ben Hutchings wrote: > > + * The new kernel version includes security restrictions on links, which > > +are enabled by default. These are specified in > > +Documentation/sysctl/fs.txt in t

Re: Linux kernel hardening - link restrictions

2012-03-03 Thread Ben Hutchings
On Thu, 2012-03-01 at 21:40 -0800, Kees Cook wrote: > On Fri, Mar 02, 2012 at 05:11:58AM +, Ben Hutchings wrote: > > The longstanding link restriction patches were recently accepted by > > Andrew Morton and are likely to end up in Linux 3.4. I've applied > > these to src:linux-2.6 in svn and t

Re: Linux kernel hardening - link restrictions

2012-03-02 Thread Henrique de Moraes Holschuh
On Fri, 02 Mar 2012, Ben Hutchings wrote: > We know that these are going to break some programs, most notably > 'at' (#597130, fixed in wheezy/sid). But of course it's possible Please consider pushing for a stable update of "at" to address this. It is extremely common to run Debian stable usersp

Re: Linux kernel hardening - link restrictions

2012-03-02 Thread Holger Levsen
Hi, On Freitag, 2. März 2012, Kees Cook wrote: > > + * The new kernel version includes security restrictions on links, > > +These restrictions may cause some legitimate programs to fail. > > +In particular, if the 'at' package is installed, you should either: > > +- Upgrade it to at l

Re: Linux kernel hardening - link restrictions

2012-03-01 Thread Lars Wirzenius
On Fri, Mar 02, 2012 at 05:11:58AM +, Ben Hutchings wrote: > + * The new kernel version includes security restrictions on links, which > +are enabled by default. These are specified in > +Documentation/sysctl/fs.txt in the linux-doc-3.2 and linux-source-3.2 > +packages. It'd be h

Re: Linux kernel hardening - link restrictions

2012-03-01 Thread Kees Cook
On Fri, Mar 02, 2012 at 05:11:58AM +, Ben Hutchings wrote: > The longstanding link restriction patches were recently accepted by > Andrew Morton and are likely to end up in Linux 3.4. I've applied > these to src:linux-2.6 in svn and they should end up in the upcoming > version 3.2.9-1. That's

Re: Linux kernel hardening - link restrictions

2012-03-01 Thread Jonas Smedegaard
On 12-03-02 at 05:11am, Ben Hutchings wrote: > The longstanding link restriction patches were recently accepted by > Andrew Morton and are likely to end up in Linux 3.4. I've applied > these to src:linux-2.6 in svn and they should end up in the upcoming > version 3.2.9-1. > > We know that these a

Linux kernel hardening - link restrictions

2012-03-01 Thread Ben Hutchings
The longstanding link restriction patches were recently accepted by Andrew Morton and are likely to end up in Linux 3.4. I've applied these to src:linux-2.6 in svn and they should end up in the upcoming version 3.2.9-1. We know that these are going to break some programs, most notably 'at' (#5971