Re: Linux kernel hardening - link restrictions

2012-03-12 Thread Vincent Lefevre
On 2012-03-08 15:42:49 +, Ben Hutchings wrote: Since 'at' is going to be updated in stable, I added a versioned 'Breaks' instead. But since there may be other problems than with at, announcing the change in the NEWS file would have probably be a good idea. Things that an admin was usually

Re: Linux kernel hardening - link restrictions

2012-03-08 Thread Vincent Lefevre
Hi, On 2012-03-02 05:11:58 +, Ben Hutchings wrote: I'm therefore intending to warn about this with the following NEWS entry in the linux-image metapackages: Index: debian/linux-image.NEWS === --- debian/linux-image.NEWS

Re: Linux kernel hardening - link restrictions

2012-03-08 Thread Ben Hutchings
On Thu, 2012-03-08 at 12:19 +0100, Vincent Lefevre wrote: Hi, On 2012-03-02 05:11:58 +, Ben Hutchings wrote: I'm therefore intending to warn about this with the following NEWS entry in the linux-image metapackages: Index: debian/linux-image.NEWS

Re: Linux kernel hardening - link restrictions

2012-03-03 Thread Ben Hutchings
On Fri, 2012-03-02 at 07:43 +, Lars Wirzenius wrote: On Fri, Mar 02, 2012 at 05:11:58AM +, Ben Hutchings wrote: + * The new kernel version includes security restrictions on links, which +are enabled by default. These are specified in +Documentation/sysctl/fs.txt in the

Re: Linux kernel hardening - link restrictions

2012-03-03 Thread Adam D. Barratt
On 02.03.2012 10:47, Holger Levsen wrote: On Freitag, 2. März 2012, Kees Cook wrote: + * The new kernel version includes security restrictions on links, +These restrictions may cause some legitimate programs to fail. +In particular, if the 'at' package is installed, you should

Re: Linux kernel hardening - link restrictions

2012-03-02 Thread Holger Levsen
Hi, On Freitag, 2. März 2012, Kees Cook wrote: + * The new kernel version includes security restrictions on links, +These restrictions may cause some legitimate programs to fail. +In particular, if the 'at' package is installed, you should either: +- Upgrade it to at least

Linux kernel hardening - link restrictions

2012-03-01 Thread Ben Hutchings
The longstanding link restriction patches were recently accepted by Andrew Morton and are likely to end up in Linux 3.4. I've applied these to src:linux-2.6 in svn and they should end up in the upcoming version 3.2.9-1. We know that these are going to break some programs, most notably 'at'

Re: Linux kernel hardening - link restrictions

2012-03-01 Thread Kees Cook
On Fri, Mar 02, 2012 at 05:11:58AM +, Ben Hutchings wrote: The longstanding link restriction patches were recently accepted by Andrew Morton and are likely to end up in Linux 3.4. I've applied these to src:linux-2.6 in svn and they should end up in the upcoming version 3.2.9-1. That's

Re: Linux kernel hardening - link restrictions

2012-03-01 Thread Jonas Smedegaard
On 12-03-02 at 05:11am, Ben Hutchings wrote: The longstanding link restriction patches were recently accepted by Andrew Morton and are likely to end up in Linux 3.4. I've applied these to src:linux-2.6 in svn and they should end up in the upcoming version 3.2.9-1. We know that these are

Re: Linux kernel hardening - link restrictions

2012-03-01 Thread Lars Wirzenius
On Fri, Mar 02, 2012 at 05:11:58AM +, Ben Hutchings wrote: + * The new kernel version includes security restrictions on links, which +are enabled by default. These are specified in +Documentation/sysctl/fs.txt in the linux-doc-3.2 and linux-source-3.2 +packages. It'd be