Bug#172436: Security concerns regarding browser proposal

2003-08-03 Thread Matt Zimmerman
On Mon, Aug 04, 2003 at 02:07:26AM +0100, Colin Watson wrote: > On Sun, Aug 03, 2003 at 07:48:43PM -0400, Matt Zimmerman wrote: > > It might be a good idea to specify how quoting should be handled, both for > > shell metacharacters and format specifiers. > > Odd, I thought I'd mentioned > http://

Bug#172436: Security concerns regarding browser proposal

2003-08-03 Thread Joey Hess
Colin Watson wrote: > On Sun, Aug 03, 2003 at 07:48:43PM -0400, Matt Zimmerman wrote: > > It might be a good idea to specify how quoting should be handled, both for > > shell metacharacters and format specifiers. > > Odd, I thought I'd mentioned > http://www.dwheeler.com/browse/secure_browser.html

Bug#172436: Security concerns regarding browser proposal

2003-08-03 Thread Joey Hess
Matt Zimmerman wrote: > It might be a good idea to specify how quoting should be handled, both for > shell metacharacters and format specifiers. Well, it's been discussed several times before, but what the hey, I guess I can discuss it one more time. My browser proposal assumes that sensible-brow

Bug#172436: Security concerns regarding browser proposal

2003-08-03 Thread Colin Watson
On Sun, Aug 03, 2003 at 07:48:43PM -0400, Matt Zimmerman wrote: > It might be a good idea to specify how quoting should be handled, both for > shell metacharacters and format specifiers. Odd, I thought I'd mentioned http://www.dwheeler.com/browse/secure_browser.html in this bug, but evidently not.

Bug#172436: Security concerns regarding browser proposal

2003-08-03 Thread Matt Zimmerman
It might be a good idea to specify how quoting should be handled, both for shell metacharacters and format specifiers. >From the existing text, it seems that "command part" means "shell command part", and it is impossible to implement this securely without specifying a scheme for handling shell me

Bug#203650: Poor recommendation in dpkg-statoverride section

2003-08-03 Thread Joey Hess
Jakob Bohm wrote: > Note that only a few packages will need these dependencies, > unlike libc6. Specifically, these packages will be needed by a > subset of the packages that currently Depends: adduser . You have to depend on adduser? Oops. Adjust your numers accordingly. :-) -- see shy jo

Re: ADMINISTRIVIA: Comments on old bug reports

2003-08-03 Thread Joey Hess
Manoj Srivastava wrote: > * #172436: debian-policy: [PROPOSAL] web browser url viewing > >Package: debian-policy; Reported by: Joey Hess <[EMAIL PROTECTED]>; >days old.236 > > This proposal was initially seconded, but then discussion > turned up some

Processed: More on severities

2003-08-03 Thread Debian Bug Tracking System
Processing commands for [EMAIL PROTECTED]: > tags 182916 + fixed Bug#182916: adding GFDL license and license manpages to base-files There were no tags set. Bug#79538: Include FDL in common-licenses Bug#172010: licenses: documentation license should be included Bug#173737: GNU Free Documentation Li

Bug#203650: Poor recommendation in dpkg-statoverride section

2003-08-03 Thread Herbert Xu
On Sun, Aug 03, 2003 at 10:23:10PM +0200, Jakob Bohm wrote: > > Also, careful examination of the adduser implementation in > woody indicates that the package really only needs its > dependencies to be unpacked, at least to add system users and > groups. The configure steps of adduser, passwd, and

Bug#203650: Poor recommendation in dpkg-statoverride section

2003-08-03 Thread Colin Watson
On Sun, Aug 03, 2003 at 10:23:10PM +0200, Jakob Bohm wrote: > On Sat, Aug 02, 2003 at 09:59:13AM +1000, Herbert Xu wrote: > > A single pre-dependency is not enough. You will need to convert all > > of adduser's dependencies into pre-dependencies, and probably most of > > the things it depends on a

Bug#203650: Poor recommendation in dpkg-statoverride section

2003-08-03 Thread Jakob Bohm
On Sat, Aug 02, 2003 at 09:59:13AM +1000, Herbert Xu wrote: > Adam Heath <[EMAIL PROTECTED]> wrote: > > > >> Objection. There is no way to create any user in preinst as the tool > >> to do so is not in an essential package. > > > > This is what pre-depends are for. > > A single pre-dependency is

Processed: Setting severities of current bugs correctly

2003-08-03 Thread Debian Bug Tracking System
Processing commands for [EMAIL PROTECTED]: > severity 114920 wishlist Bug#114920: [PROPOSAL] remove foolish consistency in perl module names Severity set to `wishlist'. > severity 128681 wishlist Bug#128681: [PROPOSAL]: Debian Menu Policy Bug#128734: [PROPOSAL]: Clarify criteria for Games/Puzzl

ADMINISTRIVIA: Comments on old bug reports

2003-08-03 Thread Manoj Srivastava
Hi, I swept through old bug reports, and here is my take on the status of old reports. Please note that several proposals are now looking for seconds. I have also taken the liberty of setting the severity of the proposed changes to be more in line with the policy-process docume

Re: Bug#193748: marked as done (debian-policy: gcc-3.3 no longer has )

2003-08-03 Thread Manoj Srivastava
On Sun, 3 Aug 2003 19:59:36 +0200, Josip Rodin <[EMAIL PROTECTED]> said: > reopen 193748 thanks > On Sun, Aug 03, 2003 at 12:18:08PM -0500, Debian Bug Tracking System > wrote: >> The new rewording of policy seems to have gotten rid of the >> offending recommendation; so this report can now be cl

Re: Bug#203650: Poor recommendation in dpkg-statoverride section

2003-08-03 Thread Manoj Srivastava
On Sat, 02 Aug 2003 09:59:13 +1000, Herbert Xu <[EMAIL PROTECTED]> said: > Adam Heath <[EMAIL PROTECTED]> wrote: >> >>> Objection. There is no way to create any user in preinst as the >>> tool to do so is not in an essential package. >> >> This is what pre-depends are for. > A single pre-depend

CVS srivasta: * invoke-rc.d and update-rc.d are now in the sysv-rc package instead of

2003-08-03 Thread Debian Policy CVS
CVSROOT:/cvs/debian-policy Module name:debian-policy Changes by: srivastaSun Aug 3 12:54:26 MDT 2003 Modified files: debian : changelog . : policy.sgml Log message: * invoke-rc.d and update-rc.d are now in the sysv-rc package instead

Processed: Re: Bug#193748: marked as done (debian-policy: gcc-3.3 no longer has )

2003-08-03 Thread Debian Bug Tracking System
Processing commands for [EMAIL PROTECTED]: > reopen 193748 Bug#193748: debian-policy: gcc-3.3 no longer has Bug reopened, originator not changed. > thanks Stopping processing here. Please contact me if you need assistance. Debian bug tracking system administrator (administrator, Debian Bugs da

Re: Bug#193748: marked as done (debian-policy: gcc-3.3 no longer has )

2003-08-03 Thread Josip Rodin
reopen 193748 thanks On Sun, Aug 03, 2003 at 12:18:08PM -0500, Debian Bug Tracking System wrote: > The new rewording of policy seems to have gotten rid of the > offending recommendation; so this report can now be closed. Indeed, I > can't find the string varargs anywhere in current polic

Bug#190749: marked as done (debian-policy: /etc/init.d scripts example 'test -f program-executed-later-in-script' should be 'test -x')

2003-08-03 Thread Debian Bug Tracking System
Your message dated Sun, 03 Aug 2003 12:16:33 -0500 with message-id <[EMAIL PROTECTED]> and subject line Bug#190749: debian-policy: /etc/init.d scripts example 'test -f program-executed-later-in-script' should be 'test -x' has caused the attached Bug report to be marked as done. This means that yo

Bug#193748: marked as done (debian-policy: gcc-3.3 no longer has )

2003-08-03 Thread Debian Bug Tracking System
Your message dated Sun, 03 Aug 2003 12:07:23 -0500 with message-id <[EMAIL PROTECTED]> and subject line Bug#193748: debian-policy: gcc-3.3 no longer has has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case

CVS srivasta: * Added myspell-dictionary to the virtual packages list closes: Bug#203728

2003-08-03 Thread Debian Policy CVS
CVSROOT:/cvs/debian-policy Module name:debian-policy Changes by: srivastaSun Aug 3 11:18:07 MDT 2003 Modified files: debian : changelog . : virtual-package-names-list.txt policy.sgml Log message: * Added myspell-dictionary to the vir

Bug#203650: Poor recommendation in dpkg-statoverride section

2003-08-03 Thread Julian Gilbey
On Thu, Jul 31, 2003 at 06:24:18PM +0100, Andrew Suffield wrote: > for i in /usr/bin/foo /usr/sbin/bar > do >if ! dpkg-statoverride --list $i >/dev/null >then > dpkg-statoverride --update --add sysuser root 4755 $i >fi > done > > The corresponding dp