On 04/11/2011 03:09 PM, Ben Eisenbraun wrote:
On Mon, Apr 11, 2011 at 08:46:36PM +0200, Kay Diederichs wrote:
<110 lines elided>
I'm a big fan of KISS - my translation would be "keep it simple and
standard". The KISS principle states that simplicity should be a key
goal in design, and that unnecessary complexity should be avoided (from
Wikipedia).
The problem is that developers can't control how their software will be
deployed, especially in the case where the packaging is a simple tarball.
Since that's the case, wouldn't it be better to build a package that runs
unmodified on as many systems as possible?
Exactly my point!
And if that's the goal and the libgomp.so.3 that's distributed with Coot is
That should be libgmp, libgomp.
not compatible with SELinux, then shouldn't it be fixed _for everyone_ on
the build system side of things?*
Any solution where the user has to modify the downloaded package in order
to run it on their system can not be considered KISS. It might be less
work than reporting the problem to the maintainers, so it might pass the
"simple" sniff test, but definitely not the "standard" one.
Alternately Paul could just put a note in the docs that says "Coot is not
compatible with SELinux" and leave it at that.
And now once this vulnerability is well documented on a public list, a
very talented teenager from (put any country name here) will put some
code up to exploit it - just give google crowler a few days to index the
list. After that it would not matter if you use selinux or not. What
would matter is if you use this broken library or not. Selinux in this
case is simply preventing user from running insecure code. If you
disable it - you are on your own.
-ben
* Note that I don't use SELinux so I have no idea how accurate this is.
--
| Ben Eisenbraun
| SBGrid Consortium | http://sbgrid.org |
| Harvard Medical School | http://hms.harvard.edu |
Leon
