All repos, not just AUR - automatic kernel module reminders

kleptophobiac · 2005-06-24 01:32:42

I think it would be a good idea to automatically email the owners of kernel module packages to update their packages when new stock kernels come out, or make it a rule to have the PKGBUILD use uname -r to get the kernel version, and have the system automatically rebuild those packages.

thoughts?

dtw · 2005-06-24 08:28:46

There is some current debate that backtick execution e.g. `uname -r` is bad in PKGBUILDs. This is the same reason I have advised you against using `date +%d` in the CVS PKGBUILD thread It's considered to be insecure by some as it allows too many security holes. So it's pretty unlikely to be adopted as a standard

With regard to kernel releases. If people are making modules for kernels and putting them in the AUR then I would hope they have an active interest in the modules and will be watching for new releases of the kernel anyway.

However, I can see this is not the case and some people are clearly contributing PKGBUILDs to the AUR purely for the sake of it then forgetting about it - that's something we are trying to work on too!

kleptophobiac · 2005-06-24 15:48:02

I don't quite understand the security risk... could you point me in the direction of some of that debate?

Snowman · 2005-06-24 16:57:00

It was discussed on the tur-users mailing list. Here`s the thread:
http://www.archlinux.org/pipermail/tur- … 01062.html

dtw · 2005-06-24 21:21:04

kleptophobiac wrote:

I don't quite understand the security risk... could you point me in the direction of some of that debate?

if you can;t be bothered to read the list it is as simple as

pkgver=`rm -rf /`

besides:

pkgver=`date +%d%m%y`

for example won't let you use gensync to create repos - so that is crap too!

kleptophobiac · 2005-06-25 01:35:48

oooh, I was trying to figure it from the other direction, like how simple commands like date and uname could be exploited.

phrakture · 2005-06-25 09:27:28

kleptophobiac wrote:

oooh, I was trying to figure it from the other direction, like how simple commands like date and uname could be exploited.

# make blow_up_computer
# make install
# mv /usr/bin/blow_up_computer /bin/date

kleptophobiac · 2005-06-25 12:51:04

Yes, but that requires there to be a binary in the tarball, and wouldn't it be a simple check to make sure there are no binaries? For packages that really needed it, there could always be exceptions (like my ivtv which requires a binary firmware)

I suppose you could always wget or tftp a binary... hmmm

yeah, this could be problematic.

Arch Linux

#1 2005-06-24 01:32:42

All repos, not just AUR - automatic kernel module reminders

#2 2005-06-24 08:28:46

Re: All repos, not just AUR - automatic kernel module reminders

#3 2005-06-24 15:48:02

Re: All repos, not just AUR - automatic kernel module reminders

#4 2005-06-24 16:57:00

Re: All repos, not just AUR - automatic kernel module reminders

#5 2005-06-24 21:21:04

Re: All repos, not just AUR - automatic kernel module reminders

#6 2005-06-25 01:35:48

Re: All repos, not just AUR - automatic kernel module reminders

#7 2005-06-25 09:27:28

Re: All repos, not just AUR - automatic kernel module reminders

#8 2005-06-25 12:51:04

Re: All repos, not just AUR - automatic kernel module reminders

Board footer