Nicolas Williams wrote: > On Mon, May 19, 2008 at 11:18:22AM -0700, Bart Smaalders wrote: >> One of the key things we're trying to do w/ IPS is use exactly >> the same mechanisms when updating an image and then >> rebooting as when updating a live system. > > Excellent. I agree. > >> I don't want to worry about rogue packaging scripts running; >> by not running any software supplied by the package except in >> the context of the image I'm installing it into, I can make such >> installations safe by design. > > If a pkg can install a service manifest and have it enabled by default, > or if it can "ping" a given FRMI which will run software installed by > that pkg, then you have to worry about rogue software running -- it > won't be rogue packaging scripts, but it can be rogue software. Kicking > the can doesn't work. >
Note my wording: "not running any software supplied by the package except in the context of the image I'm installing it into" If this wasn't clear, what I mean is that software installed into an alternate image (such as a zone being modified from the global zone, a diskless client's software being updated, etc) must _not_ be run in the current live image. > So I'm not sure that you can avoid the need to establish trust via pkg > signatures and what not, or ask questions à la SVR4 pkgadd. > > Nico We want to be able to assemble images w/o the risk of comprising the currently running image, which is _not_ the case w/ svr4 packages today. This led directly to the zones patching problems... - Bart -- Bart Smaalders Solaris Kernel Performance [EMAIL PROTECTED] http://blogs.sun.com/barts "You will contribute more with mercurial than with thunderbird." _______________________________________________ pkg-discuss mailing list [email protected] http://mail.opensolaris.org/mailman/listinfo/pkg-discuss
