Re: Apply patch for CVE-2007-0822

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Karel Zak <kzak@xxxxxxxxxx> writes:

> On Wed, May 09, 2007 at 01:06:56PM -0400, Mike Frysinger wrote:
>> On Wednesday 09 May 2007, Karel Zak wrote:
>> > On Wed, May 09, 2007 at 12:27:00PM -0400, Mike Frysinger wrote:
>> > > On Wednesday 09 May 2007, Karel Zak wrote:
>> > > >  BTW, has_uuid() is completely broken too. The both routines will be
>> > > >  fixed during work on libvolumeid support.
>> > >
>> > > this a custom jobbie ?  or you planning on using external libs like the
>> > > ones provided by e2fsprogs ?
>> >
>> >  *Only* external libs -- libblkid (e2fsprogs) or libvolume_id (udev).
>> >
>> >  See thread:
>> >  http://www.mail-archive.com/util-linux-ng@xxxxxxxxxxxxxxx/msg00158.html
>> >
>> >  I have also almost same patch from Kay Sievers who is volume_id
>> >  author.
>> 
>> i was afraid you were going to say that ;)
>
>  It will be possible to use libbklid *OR* libvolumeid. For example Suse
>  uses mount+volumeid, RHEL/FC uses mount+libblkid. 

Anyway, the patch uses blkid by default, you explicitly have to set
a configure option to use volume_id.

>> is there something libvolume_id provides that libuuid (from e2fsprogs) 
>> doesnt ?

Hmm, currently HFS+ volume detection. Though this is a minor issue and
I already sent a patch to Ted. Also volume_id is able to detect some
RAID signatures.
  
>> what i'm getting at is udev is a linux-2.6ism so relying on it kind 
>> of sucks i think ... e2fsprogs is for all linux versions ...

I won't even dare to try to start a "which lib is better discussion", this 
will lead us nowhere. Having the choice to switch between different fs 
detection libs is a big enhancement IMHO. Having the choice means also
*you* don't have to use it.

There *are* of course issues with volume_id, which needs to be discussed:
1. udev creates label symlinks by default in /dev/disk/by-label/
However the name of these links are not the label itself, but a safe label,
which is derived by the rules:
- '/' are skipped
- multiple spaces are converted to a underscore '_'
This will lead to problems when we have two volumes with label, e.g. say:
foobar and
foo/bar
I think this is a point where blkid is smarter in detecting the ambiguity.

2. Device-by-label lookup is done by following the symlink in 
/dev/disk/by-label 
You will have to know the safe label, not the real label.
When we want to do a label-by-device lookup, volume_id only provides
the label (not the safe label). AFAIK volume_id does not export the
way it derives the safe label. But this is important when we want to compare
two labels, where the first has been given (by the user) and the second
has been acquired by the label-by-device lookup. 
This is also a problem in the patch I have sent.

Matthias

-
To unsubscribe from this list: send the line "unsubscribe util-linux-ng" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Netdev]     [Ethernet Bridging]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]

  Powered by Linux