Re: Faille de sécurité dans les noyaux Linux 2.4.18 à 2.4.22

Juste pour pointer vers le thread qui a lieu actuellement sur LWN en dessous de l'annonce Debian, et qui débute avec le post "Drawback of stable kernel development" qui soulève les questions suivantes: kernel.org ne devrait-il pas mieux communiquer sur la sécurité des versions stables (sans avoir à lire LKML)? Communiquer sur la sécurité doit-il incomber aux seuls distributeurs? Quid des gens qui utilisent un kernel Vanilla? Faut-il gérer les releases comme la branche 2.2.x ou de nouvelles versions stables étaient mises en lignes à chaque découverte d'une faille importante?

http://lwn.net/Articles/60772/(...)

Un post qui résume bien la discussion

You're confusing reality with good practice. It's true that if you want to know about security problems in the current stable kernel, you have to read lkml. The reason is that none of the kernel release managers seem to care about security*. Through the 2.2 series, security issues tended to prompt new kernel releases in fairly short order; this theory of "if you care about security, read lkml or run a kernel released by someone who gives a damn" is recent and wrong. Vanilla kernels are kernels in their own right; they're not just a bunch of code which is provided to vendors solely as a starting point for a real system. More than that, they're the only kernels backed by Linus and company; no one cares about vendor kernels except for one vendor and its user base. And so, the end result of the security apathy of Alan and the others is that the most recent official release of Linux 2.4 contained a local root exploit for three months. Does anyone really believe this to be acceptable?

* The most prominent recent example: Alan's fix to the ptrace bug broke a number of other things, but once the code was written no one was particularly interested in fixing it.

NB: Je ne suis pas responsable des propos ci-dessus... Ils ont simplement le mérite de bien résumer le thread... Ne pas me moinsser pour eux quoi ;-)