Date: Wed, 31 Mar 2004 10:53:01 -0600 From: "Jacques A. Vidrine" <nectar@FreeBSD.org> To: Oliver Eikemeier <eikemeier@fillmore-labs.com> Cc: FreeBSD Security <security@FreeBSD.org> Subject: Re: cvs commit: ports/multimedia/xine Makefile Message-ID: <20040331165301.GA13952@madman.celabo.org> In-Reply-To: <40699B09.5020107@fillmore-labs.com> References: <40687E18.9060907@fillmore-labs.com> <20040329201926.GA88529@madman.celabo.org> <40689343.4080602@fillmore-labs.com> <4068A0AF.2090807@gmx.net> <4068A90A.7000104@fillmore-labs.com> <4068B881.4010304@gmx.net> <20040330045646.GD5998@madman.celabo.org> <406912E7.4040806@gmx.net> <20040330142416.GJ10949@lum.celabo.org> <40699B09.5020107@fillmore-labs.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Mar 30, 2004 at 06:06:33PM +0200, Oliver Eikemeier wrote: > Jacques A. Vidrine wrote: > > >[...] > >In that fashion, users have a choice of security policy. > > Could you elaborate a bit what you mean with `choice of > security policy'? Which different security policies are > there to choose from? Sure. Here are several invented security policies: (a) Do not install ports that have been marked FORBIDDEN. (This is the current de facto security policy.) (b) Do not install ports that have been entered into the VuXML document, and warn me of any of those that are already installed. (portaudit implements this policy) (c) Except for issues that I've marked ignore, do not install/warn me about ports that have been entered into the VuXML document. (My favorite policy.) (d) Shutdown if any ports are installed that are listed in the VuXML document. (I'm just being silly.) (e) Do not install ports with MAINTAINER=idiot@FreeBSD.org, and warn me of any of those that are already installed. (I'm just being silly.) (f) Someone could potentially maintain an adjunct database that lists just ``serious'' (by that person's definition of ``serious'') issues by VuXML ID. Do not install ports in that adjunct database. Hmm. Scenario (f) is essentially what you get when one adds FORBIDDEN= http://vuxml.freebsd.org/...vid...html to a port Makefile. As we've agreed before, ``FORBIDDEN'' is an explicity severity indicator. Other than selecting a default policy, we don't have to choose only a single one of these, but only provide tools for implementing such policies. Cheers, -- Jacques Vidrine / nectar@celabo.org / jvidrine@verio.net / nectar@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040331165301.GA13952>