On 08/26/2012 11:58, Baptiste Daroussin wrote: > On Sun, Aug 26, 2012 at 11:39:07AM -0700, Doug Barton wrote: >> On 08/26/2012 05:58, Baptiste Daroussin wrote: >> >>> The is the longer plan but this with also true with pkg_add -r, and the pkg >>> bootstrap may it be pkg-bootstrap or /usr/sbin/pkg. We have been discussing with >>> Security officers and we are waiting for the plan being written and setup by >>> them, so we can improved security in both pkgng and the bootstrap. This should >>> have happen in BSDCan, but lack of time from everyone, didn't made it happen, we >>> are now aiming at Cambridge DevSummit for that. >> >> It would be nice if this were in place before 10-current shifted to pkg >> by default in order to limit the number of times that we have to start >> testing over from scratch. >> >>> Given that such a security issue is already in with the current pkg_* tools, it >>> was accepting that we can still go that way until the policy is written, given >>> that the final goal is to have the pkgng package checked against a signature. >> >> This isn't the security issue I was talking about by having sbin/pkg >> pass every command line to local/sbin/pkg. >> >> You keep saying that you have no objections to changing the name. I am >> asking you to do that. I don't care if it is pkg-bootstrap or something >> else you like better. But please change the name to not be pkg, and >> limit the functionality of the tool to bootstrapping the pkg package. >> > > I received more feedback about keep pkg As far as I could tell the people who responded that way don't seem to be aware that every command to /usr/local/sbin/pkg is going to pass through /usr/sbin/pkg. On its face, that is a bad idea for many reasons, not the least of which is that it adds complexity where that complexity does not need to be. The larger problem with that approach is that gives an attacker 2 places to compromise the package installation process instead of just 1. This becomes even more important if the pkg bootstrap tool is the place that the public key for the digital signature is located. > and changing it to > pkg-bootstrap, so what should I do, changing it because you are asking for it? A) You said you had no objections to changing it B) I'm not the only one asking Doug -- I am only one, but I am one. I cannot do everything, but I can do something. And I will not let what I cannot do interfere with what I can do. -- Edward Everett Hale, (1822 - 1909)Received on Sun Aug 26 2012 - 17:08:49 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:30 UTC