From owner-freebsd-security@FreeBSD.ORG Mon Feb 2 19:11:43 2015 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 65AFEEBF for ; Mon, 2 Feb 2015 19:11:43 +0000 (UTC) Received: from mail-ie0-x229.google.com (mail-ie0-x229.google.com [IPv6:2607:f8b0:4001:c03::229]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 29E9E5E5 for ; Mon, 2 Feb 2015 19:11:43 +0000 (UTC) Received: by mail-ie0-f169.google.com with SMTP id rl12so19819968iec.0 for ; Mon, 02 Feb 2015 11:11:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=q4xHyP1pmd/15KzbRbCAGscjL/0/GqQSWv6DwnQGlsg=; b=NkxcslIrIHQxk3x9DxhAMjWKyHialrU4bWMwuXQZNtfE4Eec5gyfDSL8ZbWsjryApW hfCyAt/jXUa1X6AqoOJZCz0J92Hn+DhFvE9yVmVM4NJTTLT/11NOYj+ixqODdkBG/ewr eP6Z87+hlcMQfL9h+S9JhBSuDzJoCK/GKMZDMgZ4oOF7wDgeQ/cPvTKepnxgInG4/ZzK SCs5B0WHu0d88JAg1p37sDgUIaSbXNDN6ohsyeiEENeRNdFPkWfEkgreTFaCF7zwoXdJ KdBD2A73Leae46iWLyRv/AqqvEtPBKr6yO6K8/oyvadVubd00Dz/UWOVKqpsMZBMnOxw gy9g== MIME-Version: 1.0 X-Received: by 10.42.79.76 with SMTP id q12mr20475956ick.16.1422904302614; Mon, 02 Feb 2015 11:11:42 -0800 (PST) Received: by 10.36.8.215 with HTTP; Mon, 2 Feb 2015 11:11:42 -0800 (PST) In-Reply-To: <20150202185806.EC8B4884@hub.freebsd.org> References: <20150202150721.E8553209@hub.freebsd.org> <20150202152243.GA29176@in-addr.com> <20150202164319.GL11558@ivaldir.etoilebsd.net> <20150202185806.EC8B4884@hub.freebsd.org> Date: Mon, 2 Feb 2015 14:11:42 -0500 Message-ID: Subject: Re: Enumerating glibc dependencies From: Robert Simmons To: freebsd-security@freebsd.org Content-Type: text/plain; charset=UTF-8 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Feb 2015 19:11:43 -0000 On Mon, Feb 2, 2015 at 1:58 PM, Roger Marquis wrote: >> Is FreeBSD glib always linked to libc (vs glibc)? > > > Apparently it is, at least on the systems I've tested where there were no > glibc dependencies at all. Another item added to the list of BSD > (security) advantages. I believe there is a bit of confusion on the list. My assumption for why the OP wants to determine glibc dependencies is the vulnerability in gethostbyname. However, many people on the list seem to be looking for devel/glib dependencies. devel/glib in FreeBSD's ports is unrelated to glibc (take a peek at the pkg-info file for this port for more info). GLib is a component of GNOME: https://developer.gnome.org/glib/ The library that contains the glibc vulnerability is the GNU C Library: https://www.gnu.org/software/libc/