Re: Linux kernel source archive vulnerable

[Ron <iago () valhallalegends com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Hadmut Danisch wrote:
> Your assumption is false here. The kernel maintainers DO NOT say this:
> Read the README file, it does not contain any statement that you do
> not have to compile as root. They silently explain how to compile if
> you are not root, but they don't tell not to be root.


Sorry for being late, but I don't read full-disclosure often.  However,
I thought it prudent to cite this part of the Kernel README (this is
from the 2.6.10 kernel that I have installed, but I doubt it's changed):

- ----------------------
 - Do a "make" to create a compressed kernel image. It is also
   possible to do "make install" if you have lilo installed to suit the
   kernel makefiles, but you may want to check your particular lilo
   setup first.

   To do the actual install you have to be root, but none of the normal
   build should require that. Don't take the name of root in vain.
- ----------------------

Sounds like they recommend that to me?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFFqA2fqSf2EkP4p4RAlnLAJ0SgqwRzDgv+WN1i4cGK8CAQUG2AwCfXn7Y
r/5ScHzCgvUaK2fNQtRR4yI=
=QRP8
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/