Backport fix for BZ #18928?

[Carlos O'Donell]

On 12/17/2015 12:15 PM, Tulio Magno Quites Machado Filho wrote:
> "Carlos O'Donell" <carlos@redhat.com> writes:
> 
>> On 12/17/2015 11:23 AM, Tulio Magno Quites Machado Filho wrote:
>>> Mike Frysinger <vapier@gentoo.org> writes:
>>>
>>>> On 17 Dec 2015 10:32, Tulio Magno Quites Machado Filho wrote:
>>>>> Are there any restrictions to backport the patch for BZ #18928 [1] to stable
>>>>> branches?
>>>>> Right now, the only stable branch that received an update is 2.22.
>>>>
>>>> back ports are done by people interested in those branches.  no one
>>>> seems to be interested in older than 2.22, so one wasn't pushed.
>>>
>>> I'm interested and I plan to backport it to a few stable branches if we agree
>>> that's the right thing to do.
>>>
>>> But my question is more like:
>>> Is it desirable to remove support for LD_POINTER_GUARD from stable branches?
>>
>> I would be interested in hearing Florian and Joseph's opinoins on my suggestion
>> below since this is a topic that relates to our rolling release branches.
>>
>> In the glibc-2.5 era the LD_POINTER_GUARD variable was actually a workaround
>> for broken Sybase binaries that could not handle the encrypted pointers. I assume
>> they inspected libraries internals for reasons that were never clearly explained.
>> That should not be the case anymore, but we might break such programs in 2.22
>> if we remove LD_POINTER_GUARD after the release and that's a compatibility issue
>> for the stable release.
> 
> This patch has already been in glibc 2.22 since Oct. 17 as commit dc22a1ec.

Good point. In which case there isn't any work to do on 2.22, but the same answer
applies to all the other branches. It may also be that the linux man pages project
only cares about master versions that had the change and would like to avoid
a big long list of "Disabled in glibc after version 2.22, 2.23, 2.21.2, ..." So
perhaps drop the request to update the man pages project, but the version bump is
important to mark the change in behaviour IMO.

>> The up side is that this is a security issue, and that no conforming application
>> should be able to see a difference.
>>
>> In glibc-2.22 stable branch I see no reason not to disable the use of
>> LD_POINTER_GUARD, *but* you should do the following:
>>
>> - Create 2.22.2 section in NEWS and add the LD_POINTER_GUARD entry there.
>> - Bump VERSION to 2.22.2 in version.h.
>> - Commit the changes.
>> - Immediately file a patch for the linux man pages project to fix ld.so
>>   to indicate that glibc-2.22.2  (the rolling release after 2.22) has removed
>>   LD_POINTER_GUARD.
>>
>> We bump the subversion to 2 to give a demarcation point where the feature changed
>> in an important backwards-incompatible way.
> 
> Could we do that for all the other stable branches as well?

I think the answer should be "yes."

I'd like to finish the conversation with Joseph on this point first though.

Cheers,
Carlos.