From owner-freebsd-questions@FreeBSD.ORG Mon Nov 14 10:43:11 2011 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1F9D4106564A for ; Mon, 14 Nov 2011 10:43:11 +0000 (UTC) (envelope-from wafula@bitlink.co.ke) Received: from mail.bitlink.co.ke (mail.bitlink.co.ke [212.49.76.61]) by mx1.freebsd.org (Postfix) with ESMTP id 6A9988FC08 for ; Mon, 14 Nov 2011 10:43:07 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.bitlink.co.ke (Postfix) with ESMTP id 4EC1068248 for ; Mon, 14 Nov 2011 13:25:08 +0300 (EAT) Received: from mail.bitlink.co.ke ([127.0.0.1]) by localhost (mail.bitlink.co.ke [127.0.0.1]) (maiad, port 10024) with ESMTP id 51726-05 for ; Mon, 14 Nov 2011 13:25:08 +0300 (EAT) Received: from bitpc01 (unknown [192.168.2.2]) (Authenticated sender: wafula@bitlink.co.ke) by mail.bitlink.co.ke (Postfix) with ESMTPA id ECA8C678DC for ; Mon, 14 Nov 2011 13:25:07 +0300 (EAT) From: "Evalyn" To: Date: Mon, 14 Nov 2011 13:25:06 +0300 Message-ID: <005301cca2b7$add11f20$09735d60$@co.ke> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcygxmvV30wXCZgtTPmdpgs5/mmUdgBz40VwAAhna+A= Content-Language: en-gb Subject: RE: 8.2-RELEASE-p4 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Nov 2011 10:43:11 -0000 It touches the kernel but you need to do make builkernel/make installkernel before uname -a shows "8.2-RELEASE-p4". Regards, Evalyn -----Original Message----- From: owner-freebsd-questions@freebsd.org [mailto:owner-freebsd-questions@freebsd.org] On Behalf Of Matthew Seaman Sent: 12 November 2011 02:03 To: Robert Simmons Cc: freebsd-questions@freebsd.org Subject: Re: 8.2-RELEASE-p4 On 11/11/2011 21:03, Robert Simmons wrote: >> Note that if a security update is just to some userland programs, >> > freebsd-update won't touch the OS kernel, so the reported version >> > number doesn't change even though the update has been applied. In >> > these sort of cases, it's not necessary to reboot, just to restart >> > any long running processes (if any) affected by the update. The >> > security advisory should have more detailed instructions about >> > exactly what to do. (The -p2 to >> > -p3 update was like this, but the -p3 to -p4 update definitely did >> > affect the kernel so a reboot was necessary.) > I'm not confident that you are correct here. See above. Either p3-p4 > did not touch the kernel, or the OP has a legitimate question. Interesting. I based what I said on the text of the security advisories: http://security.freebsd.org/advisories/FreeBSD-SA-11:04.compress.asc http://security.freebsd.org/advisories/FreeBSD-SA-11:05.unix.asc Specifically the 'Corrected:' section near the top. I think it's clear that FreeBSD-SA-11:04.compress (Corrected in 8.2-RELEASE-p3) doesn't involve anything in the kernel but FreeBSD-SA-11:05.unix (Corrected in 8.2-RELEASE-p4) is entirely within the kernel code. Except those advisories aren't telling the whole story. Lets look at r226023 in SVN. That's the revision quoted in the 11.05 advisory. The log for newvers.sh in http://svnweb.freebsd.org/base/releng/8.2/sys/conf/newvers.sh?view=log&pathr ev=226023 says that the patches in RELEASE-p4 were not actually the security fix -- rather they fixed a problem revealed by the actual security fix, which was applied simultaneously with the patches in FreeBSD-SA-11:04.compress. 11.05 was committed in two blobs spanning -p3 and -p4. So, the good news is that if you have at least 8.2-RELEASE-p3 then you don't have any (known) security holes. However if you don't have the patches in 8.2-RELEASE-p4 then linux apps run under emulation will crash if they use unix domain sockets. The flash plugin for FireFox being the most prominent example as I recall. Now the updates for -p4 certainly should have touched the kernel, and certainly should have resulted in an updated uname string[*]. There should also be a note about -p4 in /usr/src/UPDATING. Starting to wonder if the -p4 patches are actually available via freebsd-update(8) -- could they have been omitted because it wasn't actually a security fix? Odd that no one would have commented in a whole month if so. Cheers, Matthew [*] strings /boot/kernel/kernel | grep '8\.2-' should give the same results as uname(1): if it's different then the running kernel is not the same as the one on disk... -- Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate JID: matthew@infracaninophile.co.uk Kent, CT11 9PW