From owner-freebsd-security@FreeBSD.ORG Wed Nov 10 18:31:13 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EE88316A4CF for ; Wed, 10 Nov 2004 18:31:12 +0000 (GMT) Received: from mail.freebsd.org.cn (dns3.freebsd.org.cn [61.129.66.75]) by mx1.FreeBSD.org (Postfix) with SMTP id 3339943D4C for ; Wed, 10 Nov 2004 18:31:02 +0000 (GMT) (envelope-from delphij@frontfree.net) Received: (qmail 44244 invoked by uid 0); 10 Nov 2004 18:25:32 -0000 Received: from unknown (HELO beastie.frontfree.net) (219.239.98.7) by mail.freebsd.org.cn with SMTP; 10 Nov 2004 18:25:32 -0000 Received: from localhost (localhost.frontfree.net [127.0.0.1]) by beastie.frontfree.net (Postfix) with ESMTP id 2F4EE132553; Thu, 11 Nov 2004 02:30:59 +0800 (CST) Received: from beastie.frontfree.net ([127.0.0.1]) by localhost (beastie.frontfree.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 01910-02; Thu, 11 Nov 2004 02:30:48 +0800 (CST) Received: by beastie.frontfree.net (Postfix, from userid 1001) id 231BA13254F; Thu, 11 Nov 2004 02:30:47 +0800 (CST) Date: Thu, 11 Nov 2004 02:30:46 +0800 From: Xin LI To: Julian Elischer Message-ID: <20041110183046.GA3518@frontfree.net> References: <20041110173511.GA2940@frontfree.net> <4192539C.6040403@elischer.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="rwEMma7ioTxnRzrJ" Content-Disposition: inline In-Reply-To: <4192539C.6040403@elischer.org> User-Agent: Mutt/1.4.2.1i X-GPG-key-ID/Fingerprint: 0xCAEEB8C0 / 43B8 B703 B8DD 0231 B333 DC28 39FB 93A0 CAEE B8C0 X-GPG-Public-Key: http://www.delphij.net/delphij.asc X-Operating-System: FreeBSD beastie.frontfree.net 5.3-delphij FreeBSD 5.3-delphij #11: Tue Oct 26 14:12:03 CST 2004 delphij@beastie.frontfree.net:/usr/obj/usr/src/sys/BEASTIE i386 X-URL: http://www.delphij.net X-By: delphij@beastie.frontfree.net X-Location: Beijing, China X-Virus-Scanned: by amavisd-new at frontfree.net cc: freebsd-hackers@freebsd.org cc: freebsd-security@freebsd.org Subject: Re: Is there any way to know if userland is patched? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Nov 2004 18:31:13 -0000 --rwEMma7ioTxnRzrJ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi, Julian, On Wed, Nov 10, 2004 at 09:45:00AM -0800, Julian Elischer wrote: > X-Sieve: CMU Sieve 2.2 > Date: Wed, 10 Nov 2004 09:45:00 -0800 > From: Julian Elischer > User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.8a3) Gecko/200= 41017 > X-Accept-Language: en, hu > To: Xin LI > Cc: freebsd-hackers@freebsd.org, freebsd-security@freebsd.org > Subject: Re: Is there any way to know if userland is patched? > In-Reply-To: <20041110173511.GA2940@frontfree.net> > X-Virus-Scanned: by amavisd-new at frontfree.net >=20 > Xin LI wrote: [snip] > I upgrade systems by creating packages which contain all upgraded files > I have a set of makefiles etc. checked into my local CVS tree that check = out > a freeBSD tree at a given revision and build it (withlocal patches added) > and then extracts out fies according to a list I supply. On completion I= =20 > check the list in too, so I can theoretically recreate that patch.. Hmm... Thanks for the comments. That's somewhat like the way I am current= ly using at company. We maintain a local CVS tree with a subset of ports/ tree as well as src/ tree containing some of our local changes. The tree is has several frozen branches that is maintained by a small group of staff, they make packages for the upgrades. For me, I think it might be beneficial if we can keep track of system patch= level in some other way that can be easily detected, so some ``guardian'' scripts would be easier to create. I have an idea that is somewhat too complex to be included in FreeBSD - we maintain a ``master'' patchlevel, and two patchlevels indicating the least ``master'' patchlevel that touches kernel or userland. It might be somethi= ng like this: Master | Userland | Kernel =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D+= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D+=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 4.10-RELEASE | 4.10-RELEASE | 4.10-RELEASE 4.10-RELEASE-p1 | 4.10-RELEASE | 4.10-RELEASE-p1 4.10-RELEASE-p2 | 4.10-RELEASE | 4.10-RELEASE-p2 4.10-RELEASE-p3 | 4.10-RELEASE-p3 | 4.10-RELEASE-p2 And propograte it somewhere. This is somewhat complex as the security offi= cer must bump two version when he is doing a security update and I'm not sure w= hether this is beneficial enough so I hesitate to proposal a patch of this, as I f= ound that Colin has a simpler solution in his excellent freebsd-update program, = which tracks binary changes by checking $FreeBSD$ changes. While this is sometim= es not enough to detect every changes, but it requires less human interactions. Cheers, --=20 Xin LI http://www.delphij.net/ See complete headers for GPG key and other information. --rwEMma7ioTxnRzrJ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQFBkl5W/cVsHxFZiIoRAg3XAKCFC20RJQ3FN0BTvZrI1t+QPI4zmwCfex+q Ljs+8h9tdR1gEta0ejXDD9g= =u/p+ -----END PGP SIGNATURE----- --rwEMma7ioTxnRzrJ--