linux-kernel - Re: [GIT PULL] PCI fixes for v4.20

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20181115181307.GA25806@pure.paranoia.local>
Date:   Thu, 15 Nov 2018 13:13:07 -0500
From:   Konstantin Ryabitsev <konstantin@...uxfoundation.org>
To:     Bjorn Helgaas <helgaas@...nel.org>
Cc:     Borislav Petkov <bp@...en8.de>, pr-tracker-bot@...nel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Thomas Lendacky <Thomas.Lendacky@....com>,
        Ingo Molnar <mingo@...nel.org>,
        Jonathan Cameron <Jonathan.Cameron@...wei.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Peter Zijlstra <a.p.zijlstra@...llo.nl>,
        Martin Hundebøll <martin@...nix.com>,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        Len Brown <lenb@...nel.org>, linux-acpi@...r.kernel.org
Subject: Re: [GIT PULL] PCI fixes for v4.20

On Thu, Nov 15, 2018 at 11:27:06AM -0600, Bjorn Helgaas wrote:
> > > OK, I think I'll remove the insteadOf chunk from my .gitconfig.  Should
> > > https://korg.wiki.kernel.org/userdoc/gitolite be updated to remove or
> > > expand that recommendation?  The only reason I added insteadOf in the first
> > > place was because it sounded like a security improvement.
> > 
> > It is. Does adding the insteadOf rules result in ssh:// URLs when using
> > git-request-pull? I didn't expect that it would.
> 
> Yep, it seems to for me.  Maybe I'm doing something else weird, because I
> don't see many other pull requests with ssh:// URLs.

Hmm, you're right -- I just tested this and it does. I can't imagine
that's the intended effect of insteadOf -- it's supposed to alter URLs
behind the scenes, not permanently transform them. I'll talk to git
folks about it.

For now, you should probably remove that from your gitconfig so that
your pull requests have public URLs in them.

Best,
-K