Backport fix for BZ #18928?

[Tulio Magno Quites Machado Filho]

"Carlos O'Donell" <carlos@redhat.com> writes:

> On 12/17/2015 11:23 AM, Tulio Magno Quites Machado Filho wrote:
>> Mike Frysinger <vapier@gentoo.org> writes:
>> 
>>> On 17 Dec 2015 10:32, Tulio Magno Quites Machado Filho wrote:
>>>> Are there any restrictions to backport the patch for BZ #18928 [1] to stable
>>>> branches?
>>>> Right now, the only stable branch that received an update is 2.22.
>>>
>>> back ports are done by people interested in those branches.  no one
>>> seems to be interested in older than 2.22, so one wasn't pushed.
>> 
>> I'm interested and I plan to backport it to a few stable branches if we agree
>> that's the right thing to do.
>> 
>> But my question is more like:
>> Is it desirable to remove support for LD_POINTER_GUARD from stable branches?
>
> I would be interested in hearing Florian and Joseph's opinoins on my suggestion
> below since this is a topic that relates to our rolling release branches.
>
> In the glibc-2.5 era the LD_POINTER_GUARD variable was actually a workaround
> for broken Sybase binaries that could not handle the encrypted pointers. I assume
> they inspected libraries internals for reasons that were never clearly explained.
> That should not be the case anymore, but we might break such programs in 2.22
> if we remove LD_POINTER_GUARD after the release and that's a compatibility issue
> for the stable release.

This patch has already been in glibc 2.22 since Oct. 17 as commit dc22a1ec.

> The up side is that this is a security issue, and that no conforming application
> should be able to see a difference.
>
> In glibc-2.22 stable branch I see no reason not to disable the use of
> LD_POINTER_GUARD, *but* you should do the following:
>
> - Create 2.22.2 section in NEWS and add the LD_POINTER_GUARD entry there.
> - Bump VERSION to 2.22.2 in version.h.
> - Commit the changes.
> - Immediately file a patch for the linux man pages project to fix ld.so
>   to indicate that glibc-2.22.2  (the rolling release after 2.22) has removed
>   LD_POINTER_GUARD.
>
> We bump the subversion to 2 to give a demarcation point where the feature changed
> in an important backwards-incompatible way.

Could we do that for all the other stable branches as well?

-- 
Tulio Magno