Date: Wed, 31 Mar 2004 10:53:01 -0600 From: "Jacques A. Vidrine" <nectar@FreeBSD.org> To: Oliver Eikemeier <eikemeier@fillmore-labs.com> Cc: FreeBSD Security <security@FreeBSD.org> Subject: Re: cvs commit: ports/multimedia/xine Makefile Message-ID: <20040331165301.GA13952@madman.celabo.org> In-Reply-To: <40699B09.5020107@fillmore-labs.com> References: <40687E18.9060907@fillmore-labs.com> <20040329201926.GA88529@madman.celabo.org> <40689343.4080602@fillmore-labs.com> <4068A0AF.2090807@gmx.net> <4068A90A.7000104@fillmore-labs.com> <4068B881.4010304@gmx.net> <20040330045646.GD5998@madman.celabo.org> <406912E7.4040806@gmx.net> <20040330142416.GJ10949@lum.celabo.org> <40699B09.5020107@fillmore-labs.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Mar 30, 2004 at 06:06:33PM +0200, Oliver Eikemeier wrote:
> Jacques A. Vidrine wrote:
>
> >[...]
> >In that fashion, users have a choice of security policy.
>
> Could you elaborate a bit what you mean with `choice of
> security policy'? Which different security policies are
> there to choose from?
Sure. Here are several invented security policies:
(a) Do not install ports that have been marked FORBIDDEN.
(This is the current de facto security policy.)
(b) Do not install ports that have been entered into the VuXML
document, and warn me of any of those that are already
installed.
(portaudit implements this policy)
(c) Except for issues that I've marked ignore, do not install/warn me
about ports that have been entered into the VuXML document.
(My favorite policy.)
(d) Shutdown if any ports are installed that are listed in the
VuXML document.
(I'm just being silly.)
(e) Do not install ports with MAINTAINER=idiot@FreeBSD.org, and warn
me of any of those that are already installed.
(I'm just being silly.)
(f) Someone could potentially maintain an adjunct database that lists
just ``serious'' (by that person's definition of ``serious'')
issues by VuXML ID. Do not install ports in that adjunct database.
Hmm. Scenario (f) is essentially what you get when one adds
FORBIDDEN= http://vuxml.freebsd.org/...vid...html
to a port Makefile. As we've agreed before, ``FORBIDDEN'' is an
explicity severity indicator.
Other than selecting a default policy, we don't have to choose only
a single one of these, but only provide tools for implementing such
policies.
Cheers,
--
Jacques Vidrine / nectar@celabo.org / jvidrine@verio.net / nectar@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040331165301.GA13952>