Debian Bug report logs - #47618
rbootd using /usr/local/lib <--- must die

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@carelia.infodrom.north.de>

To: submit@bugs.debian.org

Subject: rbootd using /usr/local/lib <--- must die

Date: Sun, 17 Oct 1999 04:42:00 +0200

Package: rbootd
Version: 2.0-3

Apparently this package expects the bootfiles in /usr/local/lib/rbootd
which should be /var/lib/rbootd or similar.  This is documented in the
manpage, thus you need to change the binary and the documentation.

carelia:~# strings /usr/sbin/rbootd |grep /
/lib/ld-linux.so.2
/etc/rbootd.conf
/var/run/rbootd.pid
/usr/local/lib/rbootd
/tmp/rbootd.dbg
$NetBSD: conf.c,v 1.5 1995/10/06 05:12:13 thorpej Exp $
$NetBSD: parseconf.c,v 1.4 1995/10/06 05:12:16 thorpej Exp $
$NetBSD: rbootd.c,v 1.5 1995/10/06 05:12:17 thorpej Exp $
$NetBSD: rmpproto.c,v 1.7 1996/02/01 21:27:46 mycroft Exp $
$NetBSD: utils.c,v 1.6 1995/11/14 08:41:47 thorpej Exp $

Regards,

	Joey

-- 
The good thing about standards is that there are so many to choose from.
	-- Andrew S. Tanenbaum

Please always Cc to me when replying to me on the lists.

Message #10 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@finlandia.Infodrom.North.DE>

To: 47618@bugs.debian.org

Subject: Re: Bug#47618: rbootd using /usr/local/lib <--- must die

Date: Sun, 24 Oct 1999 19:31:54 +0200

Martin Schulze wrote:
> Package: rbootd
> Version: 2.0-3
> 
> Apparently this package expects the bootfiles in /usr/local/lib/rbootd
> which should be /var/lib/rbootd or similar.  This is documented in the
> manpage, thus you need to change the binary and the documentation.

I've created fixed packages.  Here's the diff:

diff -u -Nur --exclude CVS orig/rbootd-2.0/debian/changelog rbootd-2.0/debian/changelog
--- orig/rbootd-2.0/debian/changelog	Sun Oct 24 19:12:54 1999
+++ rbootd-2.0/debian/changelog	Sun Oct 24 19:23:13 1999
@@ -1,9 +1,23 @@
+rbootd (2.0-3.1) unstable; urgency=low
+
+  * Non-maintainer release
+  * Extended changelog
+  * Changed from /usr/local/lib/rbootd to /var/lib/rbootd (closes:
+    Bug#47618)
+  * Added that directory to .deb files
+
+ -- Martin Schulze <joey@finlandia.infodrom.north.de>  Sun, 24 Oct 1999 19:23:12 +0200
+
 rbootd (2.0-3) unstable; urgency=low
+  
   * Added README file provided by Peter Maydell which gives
     useful instructions on how to set up rbootd on a debian
     system.
- -- Alan Bain <afrb2@cam.ac.uk>  Tue, 2 Feb 1999 18:00:00 +0000
+
+  -- Alan Bain <afrb2@cam.ac.uk>  Tue, 2 Feb 1999 18:00:00 +0000
+
 rbootd (2.0-2) unstable; urgency=low
+
   * Changed init script name to rbootd rather than rbootd_init
   * Moved bootfile location to /usr/local/lib/rboot rather than
     /export/hp/root (!)
@@ -13,7 +27,9 @@
   * copyright now refers to BSD copyright
   * capitalisation fixed
   * manpage paths fixed
- -- Alan Bain <afrb2@cam.ac.uk>  Sun, 21 Jun 1998 01:30:00 +0100
+
+  -- Alan Bain <afrb2@cam.ac.uk>  Sun, 21 Jun 1998 01:30:00 +0100
+
 rbootd (2.0-1) unstable; urgency=low
 
   * Created package for first time from files on Peter Maydell's
diff -u -Nur --exclude CVS orig/rbootd-2.0/debian/rules rbootd-2.0/debian/rules
--- orig/rbootd-2.0/debian/rules	Sun Oct 24 19:12:54 1999
+++ rbootd-2.0/debian/rules	Sun Oct 24 19:19:48 1999
@@ -69,6 +69,7 @@
 	  ${BASEDIR}/DEBIAN
 	install -o root -g root -m 0755 debian/{postinst,prerm,postrm} \
 	  ${BASEDIR}/DEBIAN	
+	install -d ${BASEDIR}/var/lib/rbootd
 	dpkg-shlibdeps rbootd
 	dpkg-gencontrol
 	chown -R root.root debian/tmp
diff -u -Nur --exclude CVS orig/rbootd-2.0/pathnames.h rbootd-2.0/pathnames.h
--- orig/rbootd-2.0/pathnames.h	Sun Oct 24 19:12:54 1999
+++ rbootd-2.0/pathnames.h	Sun Oct 24 19:18:57 1999
@@ -49,5 +49,5 @@
 #define	_PATH_BPF		"/dev/bpf%d"
 #define	_PATH_RBOOTDCONF	"/etc/rbootd.conf"
 #define	_PATH_RBOOTDDBG		"/tmp/rbootd.dbg"
-#define	_PATH_RBOOTDLIB		"/usr/local/lib/rbootd"
+#define	_PATH_RBOOTDLIB		"/var/lib/rbootd"
 #define	_PATH_RBOOTDPID		"/var/run/rbootd.pid"
diff -u -Nur --exclude CVS orig/rbootd-2.0/rbootd.8 rbootd-2.0/rbootd.8
--- orig/rbootd-2.0/rbootd.8	Sun Oct 24 19:12:54 1999
+++ rbootd-2.0/rbootd.8	Sun Oct 24 19:18:06 1999
@@ -140,7 +140,7 @@
 configuration file
 .It /tmp/rbootd.dbg
 debug output
-.It /usr/local/lib/rbootd
+.It /var/lib/rbootd
 directory containing boot files
 .It /var/run/rbootd.pid
 process id

Ready compiled files are found at

http://master.debian.org/~joey/NMU/rbootd_2.0-3.1.changes
http://master.debian.org/~joey/NMU/rbootd_2.0-3.1.diff.gz
http://master.debian.org/~joey/NMU/rbootd_2.0-3.1.dsc
http://master.debian.org/~joey/NMU/rbootd_2.0-3.1_i386.deb
http://master.debian.org/~joey/NMU/rbootd_2.0.orig.tar.gz

Regards,

	Joey

-- 
Never trust an operating system you don't have source for!

Please always Cc to me when replying to me on the lists.

Message #15 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@finlandia.Infodrom.North.DE>

To: 47618@bugs.debian.org

Subject: Re: Bug#47618: rbootd using /usr/local/lib <--- must die

Date: Mon, 25 Oct 1999 02:50:44 +0200

I've just checked the patches that went into the version of rbootd
that is stored at The Puffin Group's ftp server at
ftp://puffin.external.hp.com/pub/parisc/binaries/SRPMS/rbootd-2.0-2.src.rpm

Please always check the srpms in that directory since they ought to
contain current development.

Here's the patch against my last version:

diff -u -Nur --exclude CVS orig/rbootd-2.0/debian/changelog rbootd-2.0/debian/changelog
--- orig/rbootd-2.0/debian/changelog	Mon Oct 25 02:35:24 1999
+++ rbootd-2.0/debian/changelog	Mon Oct 25 02:41:11 1999
@@ -1,3 +1,12 @@
+rbootd (2.0-3.2) unstable; urgency=low
+
+  * Non-maintainer release
+  * (Joey Added rbootd-singlefile.diff from The Puffin Group / PA-RISC
+    porters from the srpm as found at
+    ftp://puffin.external.hp.com/pub/parisc/binaries/SRPMS/rbootd-2.0-2.src.rpm
+
+ -- Martin Schulze <joey@finlandia.infodrom.north.de>  Mon, 25 Oct 1999 02:41:10 +0200
+
 rbootd (2.0-3.1) unstable; urgency=low
 
   * Non-maintainer release
diff -u -Nur --exclude CVS orig/rbootd-2.0/rmpproto.c rbootd-2.0/rmpproto.c
--- orig/rbootd-2.0/rmpproto.c	Tue May  5 00:46:27 1998
+++ rbootd-2.0/rmpproto.c	Mon Oct 25 02:38:35 1999
@@ -350,6 +350,11 @@
 		if (STREQN(filename, filelist[i]))
 			goto match;
 
+	if (strlen(filename)==0) { 
+	    strcpy(filename, filelist[0]); 
+	    goto match;
+	}
+ 
 	/*
 	 *  Invalid boot file name, set error and send reply packet.
 	 */

Entire files are found at:

http://master.debian.org/~joey/NMU/rbootd_2.0-3.2.changes
http://master.debian.org/~joey/NMU/rbootd_2.0-3.2.diff.gz
http://master.debian.org/~joey/NMU/rbootd_2.0-3.2.dsc
http://master.debian.org/~joey/NMU/rbootd_2.0-3.2_i386.deb
http://master.debian.org/~joey/NMU/rbootd_2.0.orig.tar.gz

Regards,

	Joey

-- 
Never trust an operating system you don't have source for!

Please always Cc to me when replying to me on the lists.

Message #20 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@finlandia.Infodrom.North.DE>

To: Alan Bain <afrb2@cam.ac.uk>

Cc: 47618@bugs.debian.org

Subject: NMU prepared (Bug#47618: rbootd using /usr/local/lib <--- must die)

Date: Wed, 27 Oct 1999 19:48:33 +0200

I have prepared an NMU for the bugsquash party that is happening
October 30th.  I plan to upload the files on that day if you don't
object in order to get fixes into potato.  These fixes are important
if you want to boot a PA-RISC box.

The files are found at the URL listed below:

  http://master.debian.org/~joey/NMU/rbootd_2.0-3.2.changes
  http://master.debian.org/~joey/NMU/rbootd_2.0-3.2.diff.gz
  http://master.debian.org/~joey/NMU/rbootd_2.0-3.2.dsc
  http://master.debian.org/~joey/NMU/rbootd_2.0-3.2_i386.deb

Regards,

	Joey

-- 
No question is too silly to ask, but, of course, some are too silly
to answer.   -- Perl book

Please always Cc to me when replying to me on the lists.

Message #25 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@finlandia.Infodrom.North.DE>

To: 47618@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Sorry...

Date: Wed, 27 Oct 1999 19:49:51 +0200

severity 47618 important
thanks

Rationale: Using the current, non-fixed, package one cannot boot a
PA-RISC box with Linux.  The patches (see mail before) contains a 
fix from the Puffins that helps.

Regards,

	Joey

-- 
No question is too silly to ask, but, of course, some are too silly
to answer.   -- Perl book

Please always Cc to me when replying to me on the lists.

Message #32 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Alan F R Bain <A.F.R.Bain@dpmms.cam.ac.uk>

To: Martin Schulze <joey@infodrom.north.de>, 47618@bugs.debian.org

Subject: Re: Bug#47618: Sorry...

Date: Thu, 28 Oct 1999 09:23:50 +0100

Martin Schulze wrote:
>severity 47618 important
>thanks
>
>Rationale: Using the current, non-fixed, package one cannot boot a
>PA-RISC box with Linux.  The patches (see mail before) contains a 
>fix from the Puffins that helps.

As I originally used the package to boot HP9000/340s I am not too 
suprised.  I'm affraid that I didn't understand the problem before
(other than the daft location of the BOOTFILE, which is a historical
mistake).  I was working on the "if it ain't broken don't fix it"
approach as far as updates went.  Have you checked that the changes
from the Puffin group still allow the package to work for the 
9000/300 and 9000/400 series machines.  If not, then I'd like to
do some tests before the NMU if that sounds reasonable....  I didn't
actually think rbootd had any other applications which I hadn't
envisaged.

Alan Bain

Message #37 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@finlandia.Infodrom.North.DE>

To: Alan F R Bain <A.F.R.Bain@dpmms.cam.ac.uk>

Cc: Martin Schulze <joey@infodrom.north.de>, 47618@bugs.debian.org

Subject: Re: Bug#47618: Sorry...

Date: Thu, 28 Oct 1999 12:00:53 +0200

Alan F R Bain wrote:
> Martin Schulze wrote:
> >severity 47618 important
> >thanks
> >
> >Rationale: Using the current, non-fixed, package one cannot boot a
> >PA-RISC box with Linux.  The patches (see mail before) contains a 
> >fix from the Puffins that helps.
> 
> As I originally used the package to boot HP9000/340s I am not too 
> suprised.  I'm affraid that I didn't understand the problem before
> (other than the daft location of the BOOTFILE, which is a historical
> mistake).  I was working on the "if it ain't broken don't fix it"
> approach as far as updates went.  Have you checked that the changes
> from the Puffin group still allow the package to work for the 
> 9000/300 and 9000/400 series machines.  If not, then I'd like to
> do some tests before the NMU if that sounds reasonable....  I didn't
> actually think rbootd had any other applications which I hadn't
> envisaged.

I still boot my 9000/425dl box with it - though the kernel doesn't
work but that's a different issue.  Haven't found time to boot
the 9000/715 yet.  Thus: Please apply the patch.

Regards,

	Joey

-- 
Beware of bugs in the above code; I have only proved it correct,
not tried it.  -- Donald E. Knuth

Please always Cc to me when replying to me on the lists.

Message #42 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Alan F R Bain <A.F.R.Bain@dpmms.cam.ac.uk>

To: Martin Schulze <joey@infodrom.north.de>, 47618@bugs.debian.org

Subject: Re: Bug#47618: Sorry...

Date: Tue, 02 Nov 1999 10:59:43 +0000

Martin Schulze wrote:
>Alan F R Bain wrote:
>> Martin Schulze wrote:
>> >severity 47618 important
>> >thanks
>> >
>> >Rationale: Using the current, non-fixed, package one cannot boot a
>> >PA-RISC box with Linux.  The patches (see mail before) contains a 
>> >fix from the Puffins that helps.
>> 
>> As I originally used the package to boot HP9000/340s I am not too 
>> suprised.  I'm affraid that I didn't understand the problem before
>> (other than the daft location of the BOOTFILE, which is a historical
>> mistake).  I was working on the "if it ain't broken don't fix it"
>> approach as far as updates went.  Have you checked that the changes
>> from the Puffin group still allow the package to work for the 
>> 9000/300 and 9000/400 series machines.  If not, then I'd like to
>> do some tests before the NMU if that sounds reasonable....  I didn't
>> actually think rbootd had any other applications which I hadn't
>> envisaged.
>
>I still boot my 9000/425dl box with it - though the kernel doesn't
>work but that's a different issue.  Haven't found time to boot
>the 9000/715 yet.  Thus: Please apply the patch.

Thanks for doing the patch; I've also made a few other fixes which I
have missed in the past.  Most of the Puffin  patch seems to fix some
silly errors.  However I just have one question about a change to
pcap.c, so I have contacted Peter Maydell who did the original work on
this (we were at college together).  I should have a reply in the next
day, and if this is OK I'll go ahead with uploading the new package.

Alan Bain

Message #47 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@finlandia.Infodrom.North.DE>

To: Alan F R Bain <A.F.R.Bain@dpmms.cam.ac.uk>

Cc: 47618@bugs.debian.org

Subject: Re: Bug#47618: Sorry...

Date: Tue, 2 Nov 1999 12:05:13 +0100

Alan F R Bain wrote:
> Thanks for doing the patch; I've also made a few other fixes which I
> have missed in the past.  Most of the Puffin  patch seems to fix some
> silly errors.  However I just have one question about a change to
> pcap.c, so I have contacted Peter Maydell who did the original work on
> this (we were at college together).  I should have a reply in the next
> day, and if this is OK I'll go ahead with uploading the new package.

Thanks.

Regards,

	Joey

-- 
Whenever you meet yourself you're in a time loop or in front of a mirror.

Please always Cc to me when replying to me on the lists.

Message #52 received at 47618@bugs.debian.org (full text, mbox, reply):

From: pmaydell@chiark.greenend.org.uk

To: 47618@bugs.debian.org

Cc: Martin Schulze <joey@finlandia.Infodrom.North.DE>

Subject: re: rbootd using /usr/local/lib/rbootd

Date: Sun, 07 Nov 1999 13:19:17 +0000

Martin Schulze wrote:
> Apparently this package expects the bootfiles in /usr/local/lib/rbootd
> which should be /var/lib/rbootd or similar.

Hmm. We originally picked /usr/local/lib/rbootd/ on the basis that 
rbootd installs no files there -- it just arranges to serve the
files that the local sysadmin puts there. This seems to me to fit
with the policy manual's section 3.1.2 which says:

>However, the package should create empty directories below /usr/local 
>so that the system administrator knows where to place site-specific 
>files. These directories should be removed on package removal if they 
>are empty. 

Has policy changed or am I misinterpreting it? Putting things under
/var seems wrong to me as I tend to mentally mark that as "debian's use 
only, not for alteration by sysadmin", which is wrong in this case...

The long term fix, of course, is to fix rbootd so it doesn't hard
code a single directory name: then you could specify in the config
file that it should look in both a Debian-system area and a /usr/local
area.

The other patch (the one to make things work on PARISC boxen) seems
fine to me, though. 

Peter Maydell

Message #57 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@finlandia.Infodrom.North.DE>

To: pmaydell@chiark.greenend.org.uk

Cc: 47618@bugs.debian.org

Subject: Re: rbootd using /usr/local/lib/rbootd

Date: Sun, 7 Nov 1999 14:34:13 +0100

Hi!

Whoops, I wonder why you have to fiddle with it but anyway...

pmaydell@chiark.greenend.org.uk wrote:
> Martin Schulze wrote:
> > Apparently this package expects the bootfiles in /usr/local/lib/rbootd
> > which should be /var/lib/rbootd or similar.
> 
> Hmm. We originally picked /usr/local/lib/rbootd/ on the basis that 
> rbootd installs no files there -- it just arranges to serve the
> files that the local sysadmin puts there. This seems to me to fit
> with the policy manual's section 3.1.2 which says:
> 
> >However, the package should create empty directories below /usr/local 
> >so that the system administrator knows where to place site-specific 
> >files. These directories should be removed on package removal if they 
> >are empty. 

I guess you are misinterpreting policy here.  /usr/local/* is intended
to add local additions like site-specific scripts, emacs files etc.

boot-loaders and kernels to be distributed by any remote boot daemon
(e.g. rbootd) would be considered variable data and would have to
go into the /var hierarchy.

No package may depend on /usr/local/, though it may be prepared to
*also* accept input from there.

But anyway, since you're the upstream author (I guess), it's your
decision where to put that directory.  It's the job of the maintainer
of the distribution in question to modify it for the distribution's
policy.

If you're uncertain you're welcome to ask on debian-policy or
debian-devel @lists.debian.org and gather more input there.

> The long term fix, of course, is to fix rbootd so it doesn't hard
> code a single directory name: then you could specify in the config
> file that it should look in both a Debian-system area and a /usr/local
> area.

Or you specify it on the command line, that's sufficient as well,
I guess.  The best solution would be to be able to read from more
than one directories. :-)

> The other patch (the one to make things work on PARISC boxen) seems
> fine to me, though. 

Good.  I've heard of a different bug now, will try to track it
down later, having 2 other things to be done first.

Regards,

	Joey

-- 
Beware of bugs in the above code; I have only proved it correct,
not tried it.  -- Donald E. Knuth

Please always Cc to me when replying to me on the lists.

Message #62 received at 47618@bugs.debian.org (full text, mbox, reply):

From: pmaydell@chiark.greenend.org.uk

To: 47618@bugs.debian.org

Subject: re: rbootd using /usr/local/lib

Date: Sun, 07 Nov 1999 13:43:20 +0000

BTW, I just noticed that the README file also refers to
/usr/local/lib/rbootd/ and should be changed...
It also refers to 'netstd' in the last paragraph, which
should be rewritten to talk about the 'nfs-server' and
'bootparamd' packages instead.

Peter Maydell

Message #67 received at 47618@bugs.debian.org (full text, mbox, reply):

From: pmaydell@chiark.greenend.org.uk

To: Martin Schulze <joey@infodrom.north.de>

Cc: 47618@bugs.debian.org

Subject: Re: rbootd using /usr/local/lib/rbootd

Date: Sun, 07 Nov 1999 17:47:39 +0000

Martin Schulze wrote:
>pmaydell@chiark.greenend.org.uk wrote:
>> Martin Schulze wrote:
>> > Apparently this package expects the bootfiles in /usr/local/lib/rbootd
>> > which should be /var/lib/rbootd or similar.
>> 
>> Hmm. We originally picked /usr/local/lib/rbootd/ on the basis that 
>> rbootd installs no files there -- it just arranges to serve the
>> files that the local sysadmin puts there.

>I guess you are misinterpreting policy here.  /usr/local/* is intended
>to add local additions like site-specific scripts, emacs files etc.

Shrug. ISTR when we asked on debian-devel last time we got conflicting
responses :->

>boot-loaders and kernels to be distributed by any remote boot daemon
>(e.g. rbootd) would be considered variable data and would have to
>go into the /var hierarchy.
>
>No package may depend on /usr/local/, though it may be prepared to
>*also* accept input from there.

Well, regardless of where you put rbootd's data files, on installation
it's completely useless -- it will exit immediately because there
are no boot files present, until the local admin installs some...
So in a sense it inherently depends on the installation of 
local-system-specific files, even if you don't choose to put
them in /usr/local/.

>But anyway, since you're the upstream author (I guess), it's your
>decision where to put that directory.  It's the job of the maintainer
>of the distribution in question to modify it for the distribution's
>policy.

Well, I'm sort-of the upstream maintainer. I consider the NetBSD
folks to be the 'true' upstream people; I just wrote the patches
to get it working on Linux at all. Since I use Debian myself
I have a more than passing interest in its package working,
and in any case I know the maintainer...
(I haven't done much with rbootd recently anyway -- it 'works for me'
which is all I really wanted from it :->)
The NetBSD people put these things in /usr/mdec/, IIRC.

>> The long term fix, of course, is to fix rbootd so it doesn't hard
>> code a single directory name: then you could specify in the config
>> file that it should look in both a Debian-system area and a /usr/local
>> area.
>
>Or you specify it on the command line, that's sufficient as well,
>I guess.  The best solution would be to be able to read from more
>than one directories. :-)

Peter Maydell

Message #72 received at 47618@bugs.debian.org (full text, mbox, reply):

From: Alan F R Bain <A.F.R.Bain@dpmms.cam.ac.uk>

To: Martin Schulze <joey@infodrom.north.de>, 47618@bugs.debian.org

Cc: pmaydell@chiark.greenend.org.uk

Subject: Re: Bug#47618: rbootd using /usr/local/lib/rbootd

Date: Mon, 08 Nov 1999 09:59:30 +0000

Martin Schulze wrote:
>
>pmaydell@chiark.greenend.org.uk wrote:
>> Martin Schulze wrote:
>> > Apparently this package expects the bootfiles in /usr/local/lib/rbootd
>> > which should be /var/lib/rbootd or similar.

Looking in the FHS 2.0 /var/lib isn't even mentioned; I thought
this was one of the differences between FSSTD and FHS; however none
of /var/cache, /var/spool or /var/state seem at all appropriate
for the boot images.

>> Hmm. We originally picked /usr/local/lib/rbootd/ on the basis that 
>> rbootd installs no files there -- it just arranges to serve the
>> files that the local sysadmin puts there. This seems to me to fit
>> with the policy manual's section 3.1.2 which says:
>> 
>> >However, the package should create empty directories below /usr/local 
>> >so that the system administrator knows where to place site-specific 
>> >files. These directories should be removed on package removal if they 
>> >are empty. 
>
>I guess you are misinterpreting policy here.  /usr/local/* is intended
>to add local additions like site-specific scripts, emacs files etc.

My view was sort of that boot kernels for other machines were very site
specific as they depend upon the type of machines on your site! 

>boot-loaders and kernels to be distributed by any remote boot daemon
>(e.g. rbootd) would be considered variable data and would have to
>go into the /var hierarchy.

According to the FHS:
/var contains variable data files. This includes spool directories
and files, administrative and logging data, and transient and
temporary files. 

I don't think boot kernels realy fall into this category; the situation
would be different in my opinion if debian also distributed the kernel
images for the HP9000/340 series say, in which case the relevant 
package would have to install the images, so /usr/local/lib wouldn't
do.

>No package may depend on /usr/local/, though it may be prepared to
>*also* accept input from there.
>
>Or you specify it on the command line, that's sufficient as well,
>I guess.  The best solution would be to be able to read from more
>than one directories. :-)

This seems reasonably hard to achieve; On the other hand taking a directory
from the command line isn't such a big change.

Alan

Message #77 received at 47618@bugs.debian.org (full text, mbox, reply):

From: pmaydell@chiark.greenend.org.uk

To: 47618@bugs.debian.org

Cc: Martin Schulze <joey@finlandia.Infodrom.North.DE>

Subject: rbootd NMU/patch from puffin group

Date: Fri, 19 Nov 1999 00:04:27 +0000

Martin Schulze wrote:
>I have prepared an NMU for the bugsquash party that is happening
>October 30th.  I plan to upload the files on that day if you don't
>object in order to get fixes into potato.  These fixes are important
>if you want to boot a PA-RISC box.

However, the patch below introduces a buffer overrun bug...

>diff -u -Nur --exclude CVS orig/rbootd-2.0/rmpproto.c rbootd-2.0/rmpproto.c
>--- orig/rbootd-2.0/rmpproto.c  Tue May  5 00:46:27 1998
>+++ rbootd-2.0/rmpproto.c       Mon Oct 25 02:38:35 1999
>@@ -350,6 +350,11 @@
>                if (STREQN(filename, filelist[i]))
>                        goto match;
> 
>+       if (strlen(filename)==0) { 
>+           strcpy(filename, filelist[0]); 
>+           goto match;
>+       }
>+ 
>        /*
>         *  Invalid boot file name, set error and send reply packet.
>         */

because filename is not necessarily a pointer to the start of
the buffer. The upshot of this is that an attacker could segfault
the daemon by sending a suitable packet. [I don't think this is
a remote-root-exploit, though, as the attacker can't control what
is written off the end of the buffer.]

I have a potential (simple) fix to this which needs testing...
I'd be grateful if you could check that this works on the odd HPs
which need the filename=="" workaround. (I haven't tested it at
all on my own HP, mind you :->)

Am I right in believing that the above patch has not made it into
an rbootd package in the unstable tree?

Anyway, here's a better patch; I've taken the opportunity to 
get rid of the crap obfuscated ?: line which probably contributed
to the introduction of the bug by obscuring the fact that filename
might be something odd... It also wins over the original patch
by having a comment in it :->

===begin===
--- rmpproto.c.dist	Thu Nov 18 23:55:19 1999
+++ rmpproto.c	Fri Nov 19 00:00:34 1999
@@ -341,7 +341,14 @@
 	 *  stripped file name and spoof the client into thinking that it
 	 *  really got what it wanted.
 	 */
-	filename = (filename = rindex(filepath,'/'))? ++filename: filepath;
+	filename = rindex(filepath, '/');
+	if (filename) {
+		/* yes, there is a directory component to this file. Forget it. */
+		filename++;
+	} else {
+		/* No, no / in that. Use the whole filename. */
+		filename = filepath;
+	}
 
 	/*
 	 *  Check that this is a valid boot file name.
@@ -349,6 +356,16 @@
 	for (i = 0; i < C_MAXFILE && filelist[i] != NULL; i++)
 		if (STREQN(filename, filelist[i]))
 			goto match;
+
+	if (strlen(filename) == 0) {
+		/* Some models of HP apparently send a request packet
+		 * with an empty filename. We send them the first file
+		 * on the list of images valid for them.
+		 */
+		filename = filepath;
+		strncpy(filename, filelist[0], RMPBOOTDATA);
+		goto match;
+	}
 
 	/*
 	 *  Invalid boot file name, set error and send reply packet.
===endit===

Peter Maydell
[this bug report seems to cover several unrelated issues...]

Message #82 received at 47618@bugs.debian.org (full text, mbox, reply):

From: pmaydell@chiark.greenend.org.uk

To: 47618@bugs.debian.org

Cc: Martin Schulze <joey@finlandia.Infodrom.North.DE>

Subject: re: rbootd using /usr/local/lib

Date: Sat, 20 Nov 1999 15:18:59 +0000

NB: if we decide to go for /var/lib/rbootd rather than 
/usr/local/lib/rbootd it is not sufficient just to change the value 
of _PATH_RBOOTDLIB; we'll also need to at the very least add a note 
to the postinst telling the sysadmin about the change and that they 
will need to move all their boot files to /var/lib/rbootd and then 
run "/etc/init.d/rbootd restart".

Peter Maydell

Message #87 received at 47618-done@bugs.debian.org (full text, mbox, reply):

From: Alan F R Bain <A.F.R.Bain@dpmms.cam.ac.uk>

To: 47618-done@bugs.debian.org

Subject: rbootd no longer uses /usr/local/lib

Date: Mon, 29 Nov 1999 14:41:05 +0000

As of rbootd_2.0-4 the package no longer uses /usr/local/lib/rbootd for
bootfile storage; using instead /var/lib/rbootd.  It is of course necessary
for the system adminstrator to move the bootfiles to their new location
manually, since the debian package cannot alter files in /usr/local.  

A number of other changes have been made, including incorporation of Peter
Maydell's patches to the PA RISC code to prevent the exercise of a denial
of service attack.

Alan

Send a report that this bug log contains spam.