Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Andrew Gaffney
Mike Frysinger wrote: any other potential ideas ? (pretend my idea here isnt the greatest thing since Robot Chicken) Lies...nothing is better than Robot Chicken! -- Andrew Gaffney http://dev.gentoo.org/~agaffney/ Gentoo Linux Developer

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Marius Mauch
On Wed, 20 Jun 2007 00:47:04 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: mayhaps we need a new function to be run in src_install() to label files as sensitive ... so baselayout would do: esosensitive /etc/{fstab,group,passwd,shadow} and then we expand the format of CONTENTS in the vdb:

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Olivier Crête
On Wed, 2007-20-06 at 00:47 -0400, Mike Frysinger wrote: there are many files out there that contain critical information about your system ... however, there are certainly cases where the admin fully knows what they're doing and they want to create a binary package of their system with

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Matthias Schwarzott
On Mittwoch, 20. Juni 2007, Olivier Crête wrote: I will claim that almost any file in /etc is potentially sensitive (even if it does not contain passwords, if may contain other informations interesting to a cracker). And even if we did what you propose, we'd run the risk of missing some and

[gentoo-dev] VDB Changes (Was Re: how to handle sensitive files when generating binary packages)

2007-06-20 Thread Steve Long
Marius Mauch wrote: Mike Frysinger [EMAIL PROTECTED] wrote: mayhaps we need a new function to be run in src_install() to label files as sensitive ... so baselayout would do: esosensitive /etc/{fstab,group,passwd,shadow} and then we expand the format of CONTENTS in the vdb: priv /etc/fstab

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Marius Mauch
On Wed, 20 Jun 2007 15:15:20 +0200 Matthias Schwarzott [EMAIL PROTECTED] wrote: On Mittwoch, 20. Juni 2007, Olivier Crête wrote: I will claim that almost any file in /etc is potentially sensitive (even if it does not contain passwords, if may contain other informations interesting to a

[gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread Petteri Räty
It's my usual pleasure to introduce to you Ali hawking Polatel who will be joining us to help with the netmon stuff. Ali hails us from Turkey. He is currently a physics engineering stupid in the Istanbul Technical University and a real wizard in chess. He is the National Master to be more exact.

[gentoo-dev] Re: how to handle sensitive files when generating binary packages

2007-06-20 Thread Duncan
Matthias Schwarzott [EMAIL PROTECTED] posted [EMAIL PROTECTED], excerpted below, on Wed, 20 Jun 2007 15:15:20 +0200: On Mittwoch, 20. Juni 2007, Olivier Crête wrote: I will claim that almost any file in /etc is potentially sensitive (even if it does not contain passwords, if may contain

Re: [gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread Joe Peterson
Welcome Ali! And no, I don't think I will challenge you in chess any time soon. :) -Joe Petteri Räty wrote: It's my usual pleasure to introduce to you Ali hawking Polatel who will be joining us to help with the netmon stuff. Ali hails us from Turkey. He is currently a physics

Re: [gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread Wulf C. Krueger
On Wednesday, June 20, 2007 06:54:42 PM Petteri Räty wrote: It's my usual pleasure to introduce to you Ali hawking Polatel who [...] is the National Master to be more exact. Where's Deep Blue when you need it?! ;-) Welcome, Ali! Best regards, Wulf pgpElUXKlArWC.pgp Description: PGP

Re: [gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread William L. Thomson Jr.
On Wed, 2007-06-20 at 19:14 +0200, Wulf C. Krueger wrote: On Wednesday, June 20, 2007 06:54:42 PM Petteri Räty wrote: It's my usual pleasure to introduce to you Ali hawking Polatel who [...] is the National Master to be more exact. Where's Deep Blue when you need it?! ;-) Wasn't built

Re: [gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread William L. Thomson Jr.
On Wed, 2007-06-20 at 19:54 +0300, Petteri Räty wrote: It's my usual pleasure to introduce to you Ali hawking Polatel who will be joining us to help with the netmon stuff. Ali hails us from Turkey. He is currently a physics engineering stupid in the Istanbul Contrary to popular opinion, I am

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Marius Mauch wrote: Mike Frysinger [EMAIL PROTECTED] wrote: mayhaps we need a new function to be run in src_install() to label files as sensitive ... so baselayout would do: esosensitive /etc/{fstab,group,passwd,shadow} and then we expand the format of CONTENTS

Re: [gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread Luca Barbato
Petteri Räty wrote: It's my usual pleasure to introduce to you Ali hawking Polatel who will be joining us to help with the netmon stuff. Ali hails us from Turkey. He is currently a physics engineering stupid in the Istanbul Technical University and a real wizard in chess. He is the National

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Olivier Crête wrote: On Wed, 2007-20-06 at 00:47 -0400, Mike Frysinger wrote: there are many files out there that contain critical information about your system ... however, there are certainly cases where the admin fully knows what they're doing and they want

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 16:07:07 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: no reason to write off something critical like this when it can be addressed It can be addressed by banning binary package creation off an installed filesystem. -- Ciaran McCreesh signature.asc Description: PGP

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Petteri Räty
Mike Frysinger kirjoitti: On Wednesday 20 June 2007, Marius Mauch wrote: Mike Frysinger [EMAIL PROTECTED] wrote: mayhaps we need a new function to be run in src_install() to label files as sensitive ... so baselayout would do: esosensitive /etc/{fstab,group,passwd,shadow} and then we expand

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Andrew Gaffney
Ciaran McCreesh wrote: On Wed, 20 Jun 2007 16:07:07 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: no reason to write off something critical like this when it can be addressed It can be addressed by banning binary package creation off an installed filesystem. I'm not sure that's really a

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: no reason to write off something critical like this when it can be addressed It can be addressed by banning binary package creation off an installed filesystem. there's no fun in that -mike

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 15:19:46 -0500 Andrew Gaffney [EMAIL PROTECTED] wrote: I'm not sure that's really a feasible solution (but then you probably weren't suggesting it with that intention). Being able to create a backup of any installed package without re-emerging is pretty handy. Many people

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Petteri Räty wrote: Mike Frysinger kirjoitti: On Wednesday 20 June 2007, Marius Mauch wrote: Mike Frysinger [EMAIL PROTECTED] wrote: mayhaps we need a new function to be run in src_install() to label files as sensitive ... so baselayout would do: esosensitive

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 16:27:27 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: being able to generate binary packages that actually reflect the live $ROOT is desirable Is being able to generate redistributable binary packages that reflect the live ROOT desirable? -- Ciaran McCreesh

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Olivier Crête
On Wed, 2007-20-06 at 21:35 +0100, Ciaran McCreesh wrote: On Wed, 20 Jun 2007 16:27:27 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: being able to generate binary packages that actually reflect the live $ROOT is desirable Is being able to generate redistributable binary packages that

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Andrew Gaffney
Ciaran McCreesh wrote: On Wed, 20 Jun 2007 15:19:46 -0500 Andrew Gaffney [EMAIL PROTECTED] wrote: I'm not sure that's really a feasible solution (but then you probably weren't suggesting it with that intention). Being able to create a backup of any installed package without re-emerging is

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: being able to generate binary packages that actually reflect the live $ROOT is desirable Is being able to generate redistributable binary packages that reflect the live ROOT desirable? that's a

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 16:48:50 -0400 Olivier Crête [EMAIL PROTECTED] wrote: On Wed, 2007-20-06 at 21:35 +0100, Ciaran McCreesh wrote: On Wed, 20 Jun 2007 16:27:27 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: being able to generate binary packages that actually reflect the live $ROOT is

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 16:54:34 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: being able to generate binary packages that actually reflect the live $ROOT is desirable Is being able to generate

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread William L. Thomson Jr.
On Wed, 2007-06-20 at 23:18 +0300, Petteri Räty wrote: It would probably be prudent to have pristine versions of the files installed on the system (optional) so that you can actually create binary packages with all the files. If we go that direction we could have like a --live flag to

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread William L. Thomson Jr.
On Wed, 2007-06-20 at 15:53 -0500, Andrew Gaffney wrote: This still allows the social engineering attack. Someone can get a binpkg created with quickpkg of someone else's baselayout and then remove the marking that would make portage gripe. That's providing people pay attention to portage

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Ciaran McCreesh wrote: On Wed, 20 Jun 2007 16:54:34 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: being able to generate binary packages that actually reflect the

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 17:19:01 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: The specific underlying question being, what are the use cases for binary packages? the use of the binpkg is not an issue, it's the creation ... people blindly creating tbz2's which could contain their sensitive

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ned Ludd
On Wed, 2007-06-20 at 15:57 -0400, Mike Frysinger wrote: On Wednesday 20 June 2007, Marius Mauch wrote: Mike Frysinger [EMAIL PROTECTED] wrote: mayhaps we need a new function to be run in src_install() to label files as sensitive ... so baselayout would do: esosensitive

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Ned Ludd wrote: On Wed, 2007-06-20 at 15:57 -0400, Mike Frysinger wrote: On Wednesday 20 June 2007, Marius Mauch wrote: Mike Frysinger [EMAIL PROTECTED] wrote: mayhaps we need a new function to be run in src_install() to label files as sensitive ... so

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: The specific underlying question being, what are the use cases for binary packages? the use of the binpkg is not an issue, it's the creation ... people blindly creating tbz2's which could contain

Re: [gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread Thomas Raschbacher - LordVan - Gentoo
welcome here too ;) i assume Petteri means to apply sed s/stupid/student/ ? ;) unfortunately i didn't play chess in way too long so i now suck :( -- Thomas Raschbacher http://www.lordvan.com quote who=Joe Peterson Welcome Ali! And no, I don't think I will challenge you in chess any time

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 17:38:22 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: The specific underlying question being, what are the use cases for binary packages? the use of the binpkg is not an

Re: [gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread Vlastimil Babka
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thomas Raschbacher - LordVan - Gentoo wrote: i assume Petteri means to apply sed s/stupid/student/ ? ;) I assume that too. Wonder what would Freud say about this mistake :) I think Petteri is also a student himself :) Anyway, welcome Ali :) - --

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: The specific underlying question being, what are the use cases for binary packages? the use of

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Olivier Crête
On Wed, 2007-20-06 at 17:19 -0400, Mike Frysinger wrote: On Wednesday 20 June 2007, Ciaran McCreesh wrote: On Wed, 20 Jun 2007 16:54:34 -0400 Mike Frysinger [EMAIL PROTECTED] wrote: On Wednesday 20 June 2007, Ciaran McCreesh wrote: Mike Frysinger [EMAIL PROTECTED] wrote: being

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Olivier Crête wrote: On Wed, 2007-20-06 at 17:19 -0400, Mike Frysinger wrote: the use of the binpkg is not an issue, it's the creation ... people blindly creating tbz2's which could contain their sensitive files and posting them i'll just go ahead with the

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Chris Gianelloni
On Wed, 2007-06-20 at 22:01 +0100, Ciaran McCreesh wrote: The specific underlying question being, what are the use cases for binary packages? Ever managed a network of multiple Gentoo identical Gentoo machines? Compiling the exact same packages with the exact same USE/C(XX)FLAGS/LDFLAGS/etc on

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 15:31:32 -0700 Chris Gianelloni [EMAIL PROTECTED] wrote: On Wed, 2007-06-20 at 22:01 +0100, Ciaran McCreesh wrote: The specific underlying question being, what are the use cases for binary packages? Ever managed a network of multiple Gentoo identical Gentoo machines?

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Olivier Crête
On Wed, 2007-20-06 at 18:28 -0400, Mike Frysinger wrote: On Wednesday 20 June 2007, Olivier Crête wrote: On Wed, 2007-20-06 at 17:19 -0400, Mike Frysinger wrote: the use of the binpkg is not an issue, it's the creation ... people blindly creating tbz2's which could contain their sensitive

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Luca Barbato
Ciaran McCreesh wrote: On Wed, 20 Jun 2007 15:31:32 -0700 Chris Gianelloni [EMAIL PROTECTED] wrote: On Wed, 2007-06-20 at 22:01 +0100, Ciaran McCreesh wrote: The specific underlying question being, what are the use cases for binary packages? Ever managed a network of multiple Gentoo

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Olivier Crête wrote: On Wed, 2007-20-06 at 18:28 -0400, Mike Frysinger wrote: On Wednesday 20 June 2007, Olivier Crête wrote: On Wed, 2007-20-06 at 17:19 -0400, Mike Frysinger wrote: the use of the binpkg is not an issue, it's the creation ... people

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Jan Kundrát
Ciaran McCreesh wrote: what are the use cases for binary packages? Apart from those already mentioned by Chris, I use FEATURES=buildpkg to be able to recover from a catastrophic experiment with a package's content, for being able to quickly reinstall it. Although it's lame, it's pretty easy to

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Chris Gianelloni
On Wed, 2007-06-20 at 23:35 +0100, Ciaran McCreesh wrote: On Wed, 20 Jun 2007 15:31:32 -0700 Chris Gianelloni [EMAIL PROTECTED] wrote: On Wed, 2007-06-20 at 22:01 +0100, Ciaran McCreesh wrote: The specific underlying question being, what are the use cases for binary packages? Ever

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Chris Gianelloni
On Wed, 2007-06-20 at 18:50 -0400, Mike Frysinger wrote: Well, I often use quickpkg when I want to try a new version of a package (I quickpkg the currently installed one.. and I want to keep all the config files). Then I emerge the new one, and I absolutely want to be able to restore the

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Daniel Ostrow
On Wed, 2007-06-20 at 16:08 -0700, Chris Gianelloni wrote: On Wed, 2007-06-20 at 23:35 +0100, Ciaran McCreesh wrote: On Wed, 20 Jun 2007 15:31:32 -0700 Chris Gianelloni [EMAIL PROTECTED] wrote: On Wed, 2007-06-20 at 22:01 +0100, Ciaran McCreesh wrote: The specific underlying question

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Ciaran McCreesh
On Wed, 20 Jun 2007 16:08:33 -0700 Chris Gianelloni [EMAIL PROTECTED] wrote: That's one use case, yes. Now what are the others? Release building... Backups... Testing newer packages... Now expand upon those. Oh yeah,and who said we really needed more than one use case? If you make your

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Chris Gianelloni wrote: On Wed, 2007-06-20 at 18:50 -0400, Mike Frysinger wrote: Well, I often use quickpkg when I want to try a new version of a package (I quickpkg the currently installed one.. and I want to keep all the config files). Then I emerge the new

[gentoo-dev] Re: how to handle sensitive files when generating binary packages

2007-06-20 Thread Steve Long
Oh yeah,and who said we really needed more than one use case? I think providing tools to allow Gentoo to be adopted in the corporate environment is reason enough to have binary package support, and I feel that many people will agree with me. Well I'm sure you'll be over the moon to know I do

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Josh Saddler
Ciaran McCreesh wrote: On Wed, 20 Jun 2007 15:19:46 -0500 Andrew Gaffney [EMAIL PROTECTED] wrote: I'm not sure that's really a feasible solution (but then you probably weren't suggesting it with that intention). Being able to create a backup of any installed package without re-emerging is

[gentoo-dev] User warnings (Was Re: how to handle sensitive files when generating binary packages)

2007-06-20 Thread Steve Long
William L. Thomson Jr. wrote: That's providing people pay attention to portage griping in the first place. Which I would assume most don't :) Unless they have to. That's why I posted that script a few months ago: http://forums.gentoo.org/viewtopic-t-546828.html It's updated for bash 3.2 and

[gentoo-dev] Re: how to handle sensitive files when generating binary packages

2007-06-20 Thread Steve Long
Andrew Gaffney wrote: Ciaran McCreesh wrote: Andrew Gaffney wrote: I'm not sure that's really a feasible solution (but then you probably weren't suggesting it with that intention). Being able to create a backup of any installed package without re-emerging is pretty handy. Many people use it

[gentoo-dev] Re: New developer: Ali Polatel (hawking)

2007-06-20 Thread Ryan Hill
Petteri Räty wrote: It's my usual pleasure to introduce to you Ali hawking Polatel who will be joining us to help with the netmon stuff. Ali hails us from Turkey. He is currently a physics engineering stupid in the Istanbul Technical University and a real wizard in chess. He is the National

Re: [gentoo-dev] New developer: Ali Polatel (hawking)

2007-06-20 Thread Mart Raudsepp
On K, 2007-06-20 at 19:54 +0300, Petteri Räty wrote: It's my usual pleasure to introduce to you Ali hawking Polatel who will be joining us to help with the netmon stuff. Welcome Ali! Ali hails us from Turkey. He is currently a physics engineering stupid in the Istanbul Technical University

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Josh Saddler wrote: Do potential licensing/copyright issues like these factor into your proposal in any way? no, that's an exercise for the user and no one else ... there's no way i'd have the tools prevent this. about the only thing i'd add is a reminder message

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Mike Frysinger
On Wednesday 20 June 2007, Mike Frysinger wrote: On Wednesday 20 June 2007, Josh Saddler wrote: Do potential licensing/copyright issues like these factor into your proposal in any way? no, that's an exercise for the user and no one else ... there's no way i'd have the tools prevent this.

Re: [gentoo-dev] how to handle sensitive files when generating binary packages

2007-06-20 Thread Josh Saddler
Mike Frysinger wrote: On Wednesday 20 June 2007, Mike Frysinger wrote: On Wednesday 20 June 2007, Josh Saddler wrote: Do potential licensing/copyright issues like these factor into your proposal in any way? no, that's an exercise for the user and no one else ... there's no way i'd have the