headers
Cru Summers | 26 Jun 2012 20:02
Picon

how to add security advisories

Hello,

I am relatively new to netbsd and I am having a hard time understanding 
how  Security
Advisories are added. I am trying to insalled patch: Intel processors 
sysret to non-canonical address behaviour to netbsd 5.1.2.
In the netbsd docs on how to add security advisory, say: ¨ your best bet 
is to follow the instructions provided in the advisory.¨
  however, i cant not find those instructions on how to install the 
advisory in the advisory  report itself? so i am asking
if following steps  that are listed under ¨Terse summary of an updating 
procedure¨ will work:

   $ cvs update -dP   # having netbsd5.1.2 sources  installed

  cd /usr/src
$ ./build.sh -O ../obj -T ../tools tools
$ ./build.sh -O ../obj -T ../tools kernel=<KERNEL>
$ ./build.sh -O ../obj -T ../tools -U distribution

  su
# mv /netbsd /netbsd.old
# mv /usr/obj/sys/arch/≤ARCH>/compile/≤KERNEL>/netbsd /
# shutdown -r now
...
$ cd /usr/src
$ su
# ./build.sh -O ../obj -T ../tools -U install=/

or I am doing this wrong?
(Continue reading)

Permalink | Reply |
headers
Jean-Yves Migeon | 26 Jun 2012 22:07
Picon
Favicon

Re: how to add security advisories

On 26.06.2012 20:02, Cru Summers wrote:
> Hello,
>
>
> I am relatively new to netbsd and I am having a hard time understanding
> how  Security
> Advisories are added. I am trying to insalled patch: Intel processors
> sysret to non-canonical address behaviour to netbsd 5.1.2.
> In the netbsd docs on how to add security advisory, say: ¨ your best bet
> is to follow the instructions provided in the advisory.¨
>  however, i cant not find those instructions on how to install the
> advisory in the advisory  report itself? so i am asking
> if following steps  that are listed under ¨Terse summary of an updating
> procedure¨ will work:
>
>
>   $ cvs update -dP   # having netbsd5.1.2 sources  installed
>
>  [...]
> # ./build.sh -O ../obj -T ../tools -U install=/
>
>
> or I am doing this wrong?

Nope, looks correct :)

--

-- 
Jean-Yves Migeon
jeanyves.migeon <at> free.fr
(Continue reading)

Permalink | Reply |
headers
Jeremy C. Reed | 26 Jun 2012 22:54

Re: how to add security advisories

On Tue, 26 Jun 2012, Jean-Yves Migeon wrote:

> > or I am doing this wrong?
> 
> Nope, looks correct :)

But the advisory doesn't seem to indicate building and installing entire 
distribution. The advisory is not clear to me other than the "Solutions 
and Workarounds" makes it look like kernel only fix.
Permalink | Reply |
headers
Martin Husemann | 26 Jun 2012 23:39
Picon

Re: how to add security advisories

On Tue, Jun 26, 2012 at 03:54:40PM -0500, Jeremy C. Reed wrote:
> But the advisory doesn't seem to indicate building and installing entire 
> distribution. The advisory is not clear to me other than the "Solutions 
> and Workarounds" makes it look like kernel only fix.

It is a kernel only fix.

Martin
Permalink | Reply |
headers
Jean-Yves Migeon | 26 Jun 2012 23:48
Picon
Favicon

Re: how to add security advisories

On 26.06.2012 22:54, Jeremy C. Reed wrote:
> On Tue, 26 Jun 2012, Jean-Yves Migeon wrote:
> 
>>> or I am doing this wrong?
>>
>> Nope, looks correct :)
> 
> But the advisory doesn't seem to indicate building and installing entire 
> distribution. The advisory is not clear to me other than the "Solutions 
> and Workarounds" makes it look like kernel only fix.

Correct, the sysret bug requires only a kernel fix/replacement.

The commands are the ones I would recommend for a SA (without any
specifics), it never hurts to update the whole system (except the hassle
of compiling "distribution" when starting from src and not binary sets).

--

-- 
Jean-Yves Migeon
jeanyves.migeon <at> free.fr
Permalink | Reply |
headers
Cru Summers | 26 Jun 2012 23:24
Picon

Re: how to add security advisories

On 06/26/2012 01:54 PM, Jeremy C. Reed wrote:
> On Tue, 26 Jun 2012, Jean-Yves Migeon wrote:
>
>>> or I am doing this wrong?
>> Nope, looks correct :)
> But the advisory doesn't seem to indicate building and installing entire
> distribution. The advisory is not clear to me other than the "Solutions
> and Workarounds" makes it look like kernel only fix.
>
    Thanks  for the replies:-)
     to fully understand how this procedure works.
     baiscly  what i do in this case is after I install netbsd 
5.1.2-release sources into usr/src. i execute
      (to fetch updated code):

|    $||*cd /usr/src

    $cvs update -Pd*|*|  

|*

*||* then contiune on with ch 32 (compileing the kerne)l from the the 
guide.

reference:
http://www.netbsd.org/docs/guide/en/chap-kernel.html

*||**|

|**||*
(Continue reading)

Permalink | Reply |

Gmane