From owner-freebsd-current@FreeBSD.ORG Wed Nov 19 13:16:55 2003 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DFC3E16A4CE; Wed, 19 Nov 2003 13:16:55 -0800 (PST) Received: from a.mx.ict1.everquick.net (a.mx.ict1.everquick.net [67.67.61.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id B08BE43FD7; Wed, 19 Nov 2003 13:16:54 -0800 (PST) (envelope-from eddy+public+spam@noc.everquick.net) Received: from a.mx.ict1.everquick.net (localhost [127.0.0.1]) hAJLGcm1003832; Wed, 19 Nov 2003 21:16:38 GMT X-EverQuick-No-Abuse: Report any e-mail abuse to Received: from localhost (eddy@localhost)hAJLGccH003829; Wed, 19 Nov 2003 21:16:38 GMT X-Authentication-Warning: a.mx.ict1.everquick.net: eddy owned process doing -bs Date: Wed, 19 Nov 2003 21:16:37 +0000 (GMT) From: "E.B. Dreger" X-X-Sender: eddy@a.mx.ict1.everquick.net To: Scott Long In-Reply-To: <20031118164905.R35009@pooker.samsco.home> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: dyson@iquest.net cc: current@freebsd.org cc: "M. Warner Losh" Subject: Re: Unfortunate dynamic linking for everything X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Nov 2003 21:16:56 -0000 SL> Date: Tue, 18 Nov 2003 17:06:06 -0700 (MST) SL> From: Scott Long SL> 3. Binary security updates: there is a lot of interest in providing a SL> binary update mechanism for doing security updates. Having a dynamic SL> root means that vulnerable libraries can be updated without having to SL> update all of the static binaries that might use them. Although this doesn't help the upgrade process, what if one symbol (such as function name + CVS tag) were exported per function? One could check for a vulnerability by strings | grep funcname | inspect CVS tag. A more elegant approach would be to store such versioning in another segment and have a tool that understands the data, a la debugger symbols. On a different note: + Some of us have had a few bad experiences with glibc (granted, it's glibc) upgrades when the shell, cp, ls, et cetera are dynamically linked. + I put the shell of choice and all of SSH's guts on the root partition... if /usr gets clobbered, I still want to be able to boot and log in remotely. If / gets clobbered, I have bigger problems. :-) Eddy -- Brotsman & Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist@brics.com -or- alfra@intc.net -or- curbjmp@intc.net Sending mail to spambait addresses is a great way to get blocked.