This is the public Owl TODO list.  Its primary purpose is to give you
some ideas of how to contribute to Owl development (but please also
see CONVENTIONS if you do).  It is not intended as a poor replacement
for a request tracking system (although we don't yet use one) and it
is not a complete TODO list either.

Currently, this list is limited to packages.  It doesn't have to be,
so this may change.  In reality, besides the packages, there're quite
a few bits of work on Owl build environment, kernel, documentation,
and the facilities we use to run the project.

If something is listed as ASSIGNED, it doesn't mean you shouldn't
offer to do it.  Re-assigning is perfectly fine if it would seem to
help achieve the goal.  (In fact, I really don't expect some people to
complete what they've volunteered for.)


	apache.

[PRIORITY: low]
Package Russian Apache 1.3.x, but have the use of Cyrillic charsets
disabled by default (use US-ASCII or iso-8859-1).  Use mod_ssl.  Build
modules as DSO, only load the safest subset of them by default.  Make
it fail-close on suEXEC.  Clone and maintain a version of suEXEC more
friendly to virtual hosting.


	autoconf, automake, libtool.

[PRIORITY: low]
Update to latest releases.  Fix whatever other packages this will
break.  Should probably do some other core package updates first.

[PRIORITY: medium]
Deal with temporary file handling.  The RH-derived patch in libtool is
fail-open on mktemp(1).  autoconf 2.52, if we update to it, would be
fail-open on mktemp(1) in configure scripts it generates, so we'd need
to fix that.  automake.texi suggests bad practices in both 1.4 and 1.5
(look for "make DESTDIR=/tmp/staging install" and what follows).

[PRIORITY: medium]
[ASSIGNED: mci@]
With our current libtool, some software (that is not a part of Owl)
won't build unless one sets LTCONFIG_VERSION=1.3.5.  This needs to be
investigated and dealt with in the libtool package itself (unless we
update libtool first and the problem goes away).


	bash.

[PRIORITY: low]
Update to latest release (we're currently at 2.05, but 2.05b went out
a long time ago), with our patches.  Make sure it still builds cleanly
with -Wall (due to our patches).  Once again try to get our generic
fixes (the "-owl-fixes.diff") to the maintainer (haven't received a
response).


	bind.

[PRIORITY: low]
[ASSIGNED: jhuuskon@]
Package BIND 9.x, built without pthreads.  Use the query ID shuffle
code from our glibc.  Allocate and use a pseudo-user, setup and use a
chroot jail.  Ensure the PID file is dealt with safely (it shouldn't
allow for named -> root attacks on BIND itself and on our startup
scripts), preferably have it kept in the system's /var/run and as
root.


	binutils.

[PRIORITY: low]
Update to latest release.


	bison, dialog, diffstat, diffutils, file, hdparm, man-pages.

[PRIORITY: low]
[ASSIGNED: mci@]
Update these to latest releases once in a while.


	cpio, tar.

[PRIORITY: medium]
Audit for and deal with:

1. Races when creating archives: whether it may be made to leave the
intended directory tree by moving directories around, whether it may
be made to block on reading a FIFO or device, -- should probably use
O_NOFOLLOW, then fstat().  Refer to the patches to FTS code in glibc
and to mtree, both of which had similar issues.

2. Races when extracting archives: whether it will be possible for an
attacker to place [sym]links into directories being extracted such
that files in them would go to the wrong place, -- for example, when
restoring user home directories from a backup, as root.  Races between
the calls to chmod() and chown(), -- if chmod() is done first, that
would mean that permissions may be given to the wrong group for a
moment and if chown() is done first it may mean that extra permissions
are given to the file's group for a moment.  The right sequence is
chmod() to a safe mode (0700 & mode), then chown(), then chmod().

3. In cpio only: ways a malicious archive may specify that files go
outside of the intended directory tree.  This has been dealt with in
tar already.


	dhcp.

[PRIORITY: medium]
[ASSIGNED: schmidt@, solar@]
All of the DHCP suite programs should use /dev/urandom as the only
source of randomness.  The resolver should be either corrected to use
unpredictable query IDs, or dropped in favor of the one in glibc.

[PRIORITY: low]
[ASSIGNED: schmidt@, solar@]
The DHCP client should be modified to run as a dedicated pseudo-user
and in a chroot jail.  This requires privilege separation within the
client (not easy).


	fileutils, sh-utils, textutils.

[PRIORITY: medium]
Update to coreutils (one package instead of three).

Update DIR_COLORS from dircolors.hin.  In ls, dir, and vdir use
__progname instead of separate binaries with hard-coded ls_mode.


	gdb.

[PRIORITY: medium]
Investigate and deal with fd leaks into traced programs.

[PRIORITY: low]
[ASSIGNED: solar@]
Package a tool to trap unaligned accesses on Alpha.

[PRIORITY: low]
Update to latest release.


	gcc.

[PRIORITY: medium]
[ASSIGNED: Galaxy, solar@]
Update to 3.2.1+ and deal with whatever this will break.


	glibc.

[PRIORITY: medium]
[ASSIGNED: solar@]
Once gcc is updated, update to 2.3.1+ with all the related auditing,
porting, and fixing.

[PRIORITY: medium]
Develop safe log-and-exit function for use by the dlmalloc unlink()
macro's sanity check.  It will need to connect to /dev/log and write
there directly, without utilizing syslog(3).

[PRIORITY: low]
Make mkstemp(3) and friends produce unpredictable filenames (not just
unique).

[PRIORITY: low]
Fix locales to not declare characters with codes 0 to 0x1f and 0x7f to
0x9f as printable unless some really have to be.  Do it better than by
patching localedef(1) as we do now.

[PRIORITY: low]
The above problem also applies to wide character versions of the
locales which are not corrected by our current localedef(1) patch.
Either fix the locales or enhance the localedef(1) patch to also apply
to the wide character versions.  The problem is seen in particular
with the koi8-r locale for characters in the range 0x80 to 0x9f when
translated with mbrtowc() and checked with iswcntrl().  We have to
build Mutt without glibc's wide character functions for that reason.

[PRIORITY: low]
Support an /etc/libc.conf for hardening features such as zeroing out
freed memory.

[PRIORITY: low]
Investigate and deal with snprintf(3) looping and crashing with huge
field widths.


	gnupg.

[PRIORITY: medium]
Keep it to latest release.


	john.

[PRIORITY: medium]
[ASSIGNED: solar@]
Update documentation and .chr files, release as 1.7.  (Lots of other
items are in a separate non-public TODO list for just John.)


	libnet, libnids, libpcap.

[PRIORITY: low]
[ASSIGNED: nergal@]
Update to latest releases.


	mailx.

[PRIORITY: low]
Sync with current OpenBSD.

If we ever add OpenBSD's lockspool, make sure the order in which mailx
obtains fcntl() and dot-locks is compatible with that of Postfix and
procmail.


	make.

[PRIORITY: low]
Update to latest release.


	man.

[PRIORITY: low]
Allocate a pseudo-user and group for makewhatis, have makewhatis
results go under a separate directory writable by the group.  Provide
a makewhatis cron job.  Don't process cat (preformatted) pages in
makewhatis.


	mtree.

[PRIORITY: low]
Correct the man page to not refer to chflags(1) (it's a BSD'ism).
Support ext2fs flags.  Optionally don't store and ignore symlink
permissions.  Optionally dereference symlinks.


	mutt.

[PRIORITY: medium]
Extensively test all of the temporary file handling touched by our
patch.  One way to do it is start up mutt under a "strace -fF", then,
reading the patch, make use of every feature the patch touches.  Make
sure that everything works, the temporary files are dealt with safely
(as seen from the strace output), and all of them are removed on exit.

[PRIORITY: low]
[ASSIGNED: Jarno]
Consider enhancements from VVV (http://mutt.org.ua).


	ntp.

[PRIORITY: low]
Package xntp.  Use CAEN Linux patches for both xntpd and ntpdate, use
user xntpd, UID/GID 185 (already allocated).


	openssh.

[PRIORITY: medium]
[ASSIGNED: solar@]
Keep OpenSSH to latest release, with our modifications obviously.

[PRIORITY: low]
Support changing expired passwords for the privsep case as well.
Re-enable forwardings if disabled because of a forced password change.
Do PAM session management as root (again).

[PRIORITY: low]
Investigate and solve the SSH-1 sshd crashes on Alpha w/ BWX (EV56+)
for real rather than workaround them (by building deattack.c without
BWX as is done currently), unless this proves to be a CPU bug (which
it might be).


	openssl.

[PRIORITY: medium]
[ASSIGNED: solar@]
Keep OpenSSL to latest in a branch.


	owl-cdrom.

[PRIORITY: low]
Also provide a silo.conf and generic kernel configuration for SPARC.


	owl-dev.

[PRIORITY: low]
[ASSIGNED: mci@]
Migrate to MAKEDEV-C with proper modifications.


	owl-setup.

[PRIORITY: medium]
Replace with a full-featured installer which would have the ability to
guide through the installation process, including disk partitioning,
filesystem creation, "make installworld" and optionally building and
installing a kernel.  Might move from the current shell + dialog to C
or even C++ and cdk (which would then be packaged).


	owl-startup.

[PRIORITY: low]
Replace all of the RH-derived networking scripts with our own (yet to
be written).


	pam.

[PRIORITY: medium]
Update to latest release (with our modifications), either Red Hat's
again or official Linux-PAM with its pre-compiled documentation and
still adding a few modules from Red Hat's for compatibility.

[PRIORITY: low]
Add support for "include" directive per ALT Linux's proposal, using
pam-0.77-alt-pam_include.patch.  Make other packages in Owl use it.

[PRIORITY: low]
Move pam_pwdb (with its dependency on libpwdb) into a new pam-compat
subpackage.

[PRIORITY: low]
Review PAM man pages in OpenPAM (FreeBSD-current) and on other OSes,
most likely import some from OpenPAM (with minor changes for Linux-PAM
where it differs) and correct others.  Currently, the Linux-PAM man
pages are in a really bad shape.


	pam_mktemp.

[PRIORITY: low]
Do error logging.


	pam_passwdqc.

[PRIORITY: low]
(Optionally?) only display the requirements for valid passwords once
rather than before each retry (from William R. Knox).

[PRIORITY: low]
Provide some real stacking examples in the documentation.

[PRIORITY: low]
Support an external configuration file where settings common to uses
of the module by several services could reside.  (If we start using
pam_stack or add an equivalent libpam feature, that wouldn't be needed
for Owl itself any longer.)

[PRIORITY: low]
Support external wordlists and "31337" word mangling.


	patch.

[PRIORITY: low]
Solve the DoS-against-itself on the temporary file.


	perl.

[PRIORITY: low]
Re-implement temporary file handling in CGI.pm making use of File::Temp.

[PRIORITY: low]
Fix the tests (or the functions they test) such that "make test" will
no longer use /tmp when $TMPDIR is set.  Currently, with Perl 5.8.3-owl1,
3 of the tests fail when /tmp is unavailable, despite $TMPDIR being set.

[PRIORITY: low]
Determine which of the tests result in network accesses (is it just
DNS lookups?) and disable those from within our perl.spec.


	popa3d, scanlogd.

Separate, currently non-public, TODO lists exist.


	postfix.

[PRIORITY: medium]
Update to latest release, considering a number of patches and add-ons.

[PRIORITY: medium]
Restrict queue views and runs.

[PRIORITY: medium]
Open PAM sessions for programs run from .forward or LDA such that
resource limits are set.

[PRIORITY: low]
The order of fcntl() and dot-locks is currently compatible with
procmail, but not the Debian policy.  Someone should get either the
Debian policy or both Postfix and procmail corrected.


	procmail.

[PRIORITY: low]
Update to 3.22+.


	psmisc.

[PRIORITY: low]
pstree(1) should support procfs restrictions which effectively break
the process tree into several accessible subtrees.  With our current
version, only one such subtree will be dumped.


	rpm.

[PRIORITY: medium]
Update to 4.x.  Migrate to paths required by FHS (in particular,
/usr/share/{doc,man} rather than /usr/{doc,man}).  This needs to be
done after or at the same time with the glibc update because before
that it makes more sense to be package-compatible with RHL 6.x rather
than with nothing at all.  Then fix all other packages that either get
broken or are unaffected by the change here.

[PRIORITY: medium]
Audit and correct rpm's temporary file handling and its support for
package signature checking.

[PRIORITY: low]
Bug: "rpm --rebuilddb" is affected by umask.


	shadow-utils.

[PRIORITY: medium]
Optionally allow user and group names longer than 8 characters, even
though these may not be fully supported by the rest of Owl and by
third-party software.  This should be two settings in /etc/login.defs,
with proper documentation in comments in that file and in the man page
(including the cross reference for which commands are affected).
There should still a be check for usernames exceeding
sizeof(ut.ut_user) and some sane "hard" limits for both user and group
names (or the shadow suite programs themselves would misbehave).

[PRIORITY: medium]
When usermod is invoked with "-p" (to change password), it should set
the last change time.


	SimplePAMApps.

[PRIORITY: low]
login should accept IP addresses rather than hostnames such that it
can log both into wtmp.


	strace.

[PRIORITY: low]
32-bit UID handling with Linux 2.4.x (should look at the package in
ALT Linux first).

[PRIORITY: low]
Deal with incorrect pipe(2) reporting on Alpha.


	sysklogd.

[PRIORITY: medium]
chown to syslogd (group or user if the group permissions are already
in use) in syslogd itself.

[PRIORITY: low]
Protect against timestamp spoofing.

[PRIORITY: low]
In klogd, support new System.map format used starting with recent
2.2.x kernels on Alpha.

[PRIORITY: low]
Migrate to a better alternative for syslogd, retain this package for
klogd.  Most likely go with a clone of Darren Reed's nsyslogd, which
we will likely have to maintain ourselves.


	SysVinit.

[PRIORITY: low]
Keep to latest release.


	telnet.

[PRIORITY: low]
Sync with current OpenBSD.

[PRIORITY: low]
Pass IP addresses to login once it supports that.

[PRIORITY: low]
Re-enable IPv6 in the client once glibc is fixed.


	traceroute.

[PRIORITY: medium]
Replace with Olaf Kirch's after we fully migrate to Linux 2.4.x.


	vim.

[PRIORITY: low]
Update to latest 6.1 patchlevel.

[PRIORITY: low]
Use mkdtemp(3) for the directory after the glibc update.


	vixie-cron.

[PRIORITY: low]
Sync with current OpenBSD (now based on Vixie Cron 4.0b1).

[PRIORITY: medium]
Open PAM sessions for cron jobs such that resource limits are set.
Reject or support long usernames in crontab(1).


	vsftpd.

[PRIORITY: low]
Keep to latest release.


	xinetd.

[PRIORITY: medium]
Do ident lookups (if enabled) as a dedicated pseudo-user.

[PRIORITY: low]
Develop and migrate to a cleaner replacement, with some limited
configuration file compatibility.

$Id: TODO,v 1.29.2.1 2004/04/13 21:44:25 solar Exp $
