From owner-freebsd-security@FreeBSD.ORG Sat Sep 27 15:50:01 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5A18216A4B3 for ; Sat, 27 Sep 2003 15:50:01 -0700 (PDT) Received: from arginine.spc.org (arginine.spc.org [195.206.69.236]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4A28544014 for ; Sat, 27 Sep 2003 15:49:59 -0700 (PDT) (envelope-from bms@spc.org) Received: from localhost (localhost [127.0.0.1]) by arginine.spc.org (Postfix) with ESMTP id DA48665414; Sat, 27 Sep 2003 23:49:57 +0100 (BST) Received: from arginine.spc.org ([127.0.0.1]) by localhost (arginine.spc.org [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 31899-04-3; Sat, 27 Sep 2003 23:49:57 +0100 (BST) Received: from saboteur.dek.spc.org (lardystuffer.demon.co.uk [212.228.40.202]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by arginine.spc.org (Postfix) with ESMTP id 27B1265344; Sat, 27 Sep 2003 23:49:56 +0100 (BST) Received: by saboteur.dek.spc.org (Postfix, from userid 1001) id 4DD183F; Sat, 27 Sep 2003 23:49:49 +0100 (BST) Date: Sat, 27 Sep 2003 23:49:49 +0100 From: Bruce M Simpson To: "V. Jones" Message-ID: <20030927224949.GB11185@saboteur.dek.spc.org> Mail-Followup-To: "V. Jones" , freebsd-security@freebsd.org References: <11778415.1064691636010.JavaMail.root@skeeter.psp.pas.earthlink.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <11778415.1064691636010.JavaMail.root@skeeter.psp.pas.earthlink.net> cc: freebsd-security@freebsd.org Subject: Re: FreeBSD Patch question X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Sep 2003 22:50:01 -0000 On Sat, Sep 27, 2003 at 03:40:35PM -0400, V. Jones wrote: > Thanks to everyone who responded - my question really had more to do with applying patches as they are presented in the various security advisories. It sounds like most of you don't do it that way; it sounds like you track freebsd-stable using cvsup. However, section 21.2.2.2 of the handbook seems to advise against doing this when all you want to do is apply security fixes: > > "While it is true that security fixes also go into the FreeBSD-STABLE branch, you do not need to track FreeBSD-STABLE to do this. Every security advisory for FreeBSD explains how to fix the problem for the releases it affects [1] , and tracking an entire development branch just for security reasons is likely to bring in a lot of unwanted changes as well." You can track a RELEASE branch instead, this is one reason for their existence. Only security-officer@ has the power to mandate that a patch be committed to a release branch after it has been released. This is what I do for my production machines. BMS