Release managers' mistake [LWN.net]

Release managers' mistake

Posted Dec 1, 2003 23:47 UTC (Mon) by bgilbert (subscriber, #4738)
In reply to: sysadmin's mistake by xose
Parent article: A Debian kernel security update

You're confusing reality with good practice. It's true that if you want to know about security problems in the current stable kernel, you have to read lkml. The reason is that none of the kernel release managers seem to care about security*. Through the 2.2 series, security issues tended to prompt new kernel releases in fairly short order; this theory of "if you care about security, read lkml or run a kernel released by someone who gives a damn" is recent and wrong. Vanilla kernels are kernels in their own right; they're not just a bunch of code which is provided to vendors solely as a starting point for a real system. More than that, they're the only kernels backed by Linus and company; no one cares about vendor kernels except for one vendor and its user base. And so, the end result of the security apathy of Alan and the others is that the most recent official release of Linux 2.4 contained a local root exploit for three months. Does anyone really believe this to be acceptable?

* The most prominent recent example: Alan's fix to the ptrace bug broke a number of other things, but once the code was written no one was particularly interested in fixing it.

(Log in to post comments)

Release managers' mistake

Posted Dec 2, 2003 7:27 UTC (Tue) by Ross (subscriber, #4065) [Link]

I certainly agree with you and I had similar feelings with delayed security
(and ext3 corruption) fixes for other 2.4 releases and missing security
patches in 2.6 which are present in 2.4.

Release managers' mistake

Posted Dec 2, 2003 9:44 UTC (Tue) by wichert (subscriber, #7115) [Link]

Kernel release managers definitely care about security and kernel security are always discussed by vendors and the relevant kernel folks. In this case the fix had been known for a while, but nobody realised just how dangerous this bug was. With a project as complicated and filled with subtleties that is not all that unexpected.

Your example of Alan's fix for the ptrace bug actually is a fine counterexample of your suggestion that kernel maintainers do not care about security: it was quickly fixed even though the fix broke a few things. Alan fixed the ptrace hole quickly to fix the security problem and relied on others to fix the fallout while he could focus on more pressing issues.

Release managers' mistake

Posted Dec 2, 2003 12:41 UTC (Tue) by hppnq (subscriber, #14462) [Link]

Plus, IIRC Alan was very much involved with 2.2, which sort of makes the whole statement moot. ;-)

And of course it is the responsibility of sysadmins to apply patches or fix problems if necessary. Waiting for the next release is just not good enough, sometimes.