pinyo_villany blogja

[code]
This is the start of the stable review cycle for the 2.6.22.19 release.
There are 23 patches in this series, all will be posted as a response to
this one. If anyone has any issues with these being applied, please let
us know. If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the
Cc: line. If you wish to be a reviewer, please email stable<>kernel.org
to add your name to the list. If you want to be off the reviewer list,
also email us.

Responses should be made by Monday, Feb 24, 2008, 22:00:00 UTC.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.22.19-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h
[code]

git tree : http://repo.or.cz/w/linux-2.6.22.y-op.git testing

a verziót csak én emeltem, hivatalos kernel tudomásom szerint már nincs folytatva ...
talán még a 2.6.22.19-es ki lesz adva valamikor, de nem biztos, ezért folytatom én valamilyen szinten a fixek betolását...

chlog v2.6.22.18..v2.6.22.19-opt1:

...

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1466-2 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
January 19, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : xorg-server, libxfont, xfree86
Vulnerability : several
Problem type : local
Debian-specific: no
CVE Id(s) : CVE-2007-5760 CVE-2007-5958 CVE-2007-6427 CVE-2007-6428 CVE-2007-6429 CVE-2008-0006

Security hardening for Debian

Making the programs in a distribution more resistant to exploits—a process known as hardening—is a fairly common way to reduce the attack surface for the distribution. Many distributions have made an effort in this area, with some adding in an overall security architecture, like AppArmor for SUSE or SELinux for Red Hat and Fedora distributions. Debian is currently looking at enabling some hardening features, potentially throughout a large swath of packages that it distributes. The features being considered and the concerns raised provide an interesting look at the tradeoffs.
A posting to debian-devel-announce regarding hardening features for Lenny started the conversation. Those packages that are most susceptible—network services, packages that parse files from untrusted sources, or those that have been the subject of a security alert—should enable a set of security tools that will help deflect attacks against them. Various attacks rely upon certain characteristics of Linux binaries that allow them to be exploited. By altering the way the binaries are built, those particular threats can be mitigated.

Hi,

I just read the excellent LWN writeup of the vmsplice security thing, and that got me
wondering why this attack wasn't stopped by the CONFIG_CC_STACKPROTECTOR option... because
it plain should have been...

some analysis later.. it turns out that the following line in the top level Makefile,
added by you in October 2007, entirely disables CONFIG_CC_STACKPROTECTOR ;(
With this line removed the exploit will be nicely stopped.

# Force gcc to behave correct even for buggy distributions
CFLAGS += $(call cc-option, -fno-stack-protector)

Now I realize that certain distros have patched gcc to compensate for their lack of distro
wide CFLAGS, and it's great to work around that... but would there be a way to NOT
disable this for CONFIG_CC_STACKPROTECTOR please? It would have made this
exploit not possible for those kernels that enable this feature (and that includes distros
like Fedora)

A CVE-2008-0600 hibajavítást tartalmazza

http://repo.or.cz/w/linux-2.6.22.y-op.git

master (v2.6.22.18) -> vanilla kernel
testing (v2.6.22.18-opt1):
 * 2.6.22.18
  + stable queue-2.6.22.y patchek
  +  quicklists: Only consider memory that can be used with GFP_KERNEL

akit érdekel a v2.6.22.y kernel széria

-optX -> testing
-opdX -> develop
-opX -> stable

---------

jelenleg a tesingben benne vannak a kernel.org-os queue-2.6.22-s patchek + 1 quicklist fix, ami egy oom-fix; devel branchben pár suse-os fix ...

http://repo.or.cz/w/linux-2.6.22.y-op.git

[code]
We (the -stable team) are announcing the release of the 2.6.22.17
kernel.

It contains a number of bugfixes, and all users of the 2.6.22 series are
encouraged to upgrade.

I'll also be replying to this message with a copy of the patch between
2.6.22.16 and 2.6.22.17

The updated 2.6.22.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.22.y.git;a=s…

thanks,

greg k-h

--------

Makefile | 2
arch/powerpc/mm/hash_utils_64.c | 2
arch/sparc64/kernel/chmc.c | 16 +++--
arch/sparc64/kernel/entry.S | 12 +++
arch/sparc64/kernel/smp.c | 19 ++++--
arch/sparc64/mm/init.c | 29 ++++++---
drivers/acpi/dispatcher/dsobject.c | 91 ++++++++++++++++++++++++++++--
drivers/atm/nicstar.c | 19 ++----
drivers/char/drm/drm_vm.c | 2
drivers/char/mspec.c | 3
drivers/connector/cn_queue.c | 2
drivers/net/cassini.c | 45 +++-----------
drivers/net/cassini.h | 18 ++---
drivers/net/chelsio/cxgb2.c | 66 ++++++++++++++++-----
drivers/net/chelsio/pm3393.c | 112 ++++++++++++++-----------------------
drivers/net/chelsio/sge.c | 40 +++++--------
drivers/net/chelsio/sge.h | 3
drivers/net/usb/kaweth.c | 2
drivers/net/usb/mcs7830.c | 4 -
drivers/pci/quirks.c | 6 +
fs/exec.c | 6 +
fs/ncpfs/mmap.c | 3
include/asm-sparc64/hypervisor.h | 4 +
include/linux/pci_ids.h | 2
kernel/relay.c | 1
mm/mmap.c | 2
net/atm/mpc.c | 7 ++
net/ax25/ax25_in.c | 2
net/ipv4/devinet.c | 2
net/ipv4/ip_gre.c | 2
net/ipv4/route.c | 8 +-
net/irda/af_irda.c | 2
net/key/af_key.c | 14 +++-
net/netrom/nr_dev.c | 2
net/x25/x25_forward.c | 5 -
net/xfrm/xfrm_policy.c | 9 +-
sound/oss/via82cxxx_audio.c | 14 +---
sound/usb/usx2y/usX2Yhwdep.c | 2
sound/usb/usx2y/usx2yhwdeppcm.c | 2
39 files changed, 355 insertions(+), 227 deletions(-)

This is the start of the stable review cycle for the 2.6.22.17 release.
There are 27 patches in this series, all will be posted as a response to
this one. If anyone has any issues with these being applied, please let
us know. If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the
Cc: line. If you wish to be a reviewer, please email stable@kernel.org
to add your name to the list. If you want to be off the reviewer list,
also email us.

Responses should be made by Feb 5 2008, 00:00:00 UTC. Anything received
after that time might be too late.

We (the -stable team) are announcing the release of the 2.6.22.16
kernel.

It contains a single fix for a problem that could cause a local user to
cause file system corruption on some types of filesystems.

All users of the 2.6.22 series are encouraged to upgrade.

I'll also be replying to this message with a copy of the patch between
2.6.22.15 and 2.6.22.16

The updated 2.6.22.y git tree can be found at:
        git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
and can be browsed at the normal kernel.org git web browser:
        http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.22.y.git;a=summary

thanks,

greg k-h

és igen, megint feltoltam

a különbség csak annyi, hogy most a deb csomagokat is frissítettem

eddig néztem BME, ELTE esetleg SzTE és Pannon

...

:DDD

idebent ajándék!

next

egy újabb ..

ez kész ...

re

megjött ez is

http://www.helenos.eu/

megjelent a v2.6.22.13-as kernel, mely GKH hosszú karbantartású tree-je lett.

...

Future of Linux 2.6.22.y series

és megjelent ...