Re: libressl-2.1.6 on AIX

2015-04-10 Thread Michael Felt
After this change and autoconf, and configure... diff -ur ../portable.a/configure.ac ../portable.b/configure.ac --- ../portable.a/configure.ac 2015-04-10 03:59:16 + +++ ../portable.b/configure.ac 2015-04-10 20:41:33 + @@ -15,8 +15,6 @@ AC_PROG_LIBTOOL LT_INIT -CFLAGS="$CFLAGS -Wall -st

Re: libressl-2.1.6 on AIX

2015-04-10 Thread Michael Felt
>Also, I didn't add the configure.ac line that set CFLAGS to empty string that was in >the original patch. The current master branch has switched to letting autoconf >initialize the CFLAGS directly. This worked fine with gcc when I tried it, but I'd be >interested in seeing how it works with other

Re: libressl-2.1.6 on AIX

2015-04-09 Thread Theo de Raadt
> Just to make sure I understand what is expected of isssetguid() - could you > perhaps, in terms of ls -l output with suid programs describe the > sequence(s) where the value should be 1 - and especially, when they might > (read should) be 0. > > >From memory of what I read (how I understood) the

Re: libressl-2.1.6 on AIX

2015-04-09 Thread Michael Felt
I shall look at collecting the in-tree stuff. My servers are in the netherlands, and I am in austin atm. I have a meeting with the security team in about 30 minutes and I am going to mention libressl and get a discussion going. One of the things I wanted to discuss is about priv escalation. Just

Re: libressl-2.1.6 on AIX

2015-04-08 Thread Brent Cook
Thanks Michael, I have incorporated some initial AIX patches - can you please check out the latest tree? https://github.com/libressl-portable/portable/commit/fe3f7fc6365bfaac3418a72256b8c11603e80cbf https://github.com/libressl-portable/openbsd/commit/37d8e3c080e7c73158093f253d8e06fa1906dc03 Th

libressl-2.1.6 on AIX

2015-04-08 Thread Michael Felt
I applied the patch I had sent in before, made one change (correction) - correcting a typo that brent had pointed out (netinfo that needs to be "diskinfo") in the getentrophy_aix.c If you need the patch again, I can send it again. I am curious about whether this is moving forward - and if there is