Fwd: Bug#566351: libgcrypt11: should not change user id as a side effect

[Dan Kegel]

After gstreamer, gcrypt is also dropping support for alternative
thread libraries.
Good thing secur32/schannel_gnutls.c doesn't use it.  (Right?)
- Dan

---------- Forwarded message ----------
From: Werner Koch 
Date: Wed, Nov 7, 2012 at 1:31 AM
Subject: Re: Bug#566351: libgcrypt11: should not change user id as a side effect
To: Andreas Metzler 
Cc: [e-mail], [e-mail]

On Sat,  3 Nov 2012 18:29, [e-mail] said:
> comment sums it up:
> https://bugs.launchpad.net/debian/+source/sudo/+bug/423252/comments/72

Well, it is the usual problem with inter-library dependencies.  We will
never be able to get this right.  The DSO is just not designed to work
with completely independent libraries.  I don't like to say, but in this
regard Windows DLLs are a better solution.

Although we can't solve all the problems we will be able to solve the
thread initialization problem.  Libgcrypt 1.6 will ignore the thread
callbacks and assume pthread.  Semaphores are then used for locking and
provide a way to do thread-safe initialization.  The hopefully minor
drawback is that one needs to link against librt.
> -
> case GCRYCTL_SET_THREAD_CBS:
> -
>   err = ath_install (va_arg (arg_ptr, void *), any_init_done);
>
> +-      if (! err)
> +-      global_init ();

Okay, if that works, fine.  It might break other things; I don't know.
There are enough selftests to hopefully detect such a break (in
particular in FIPS mode).

Salam-Shalom,

Werner

--
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

_______________________________________________
Gcrypt-devel mailing list
[e-mail]
http://lists.gnupg.org/mailman/listinfo/gcrypt-devel

Bug#566351: libgcrypt11: should not change user id as a side effect

[Juan Lang]

On Wed, Nov 7, 2012 at 3:22 AM, Dan Kegel  wrote:
> After gstreamer, gcrypt is also dropping support for alternative
> thread libraries.
> Good thing secur32/schannel_gnutls.c doesn't use it.  (Right?)

Right.

If someone were motivated, we could begin to transition winhttp and wininet
to schannel instead of  OpenSSL, and we could eliminate this dependency.
It's a lot to ask, but it seems, subjectively, like schannel has gotten
enough love to be workable for most sites by now.
--Juan