This is the public Owl TODO list.  Its primary purpose is to give you
some ideas of how to contribute to Owl development (but please also
see CONVENTIONS if you do).  It is not intended as a poor replacement
for a request tracking system (although we don't yet use one) and it
is not a complete TODO list either.

Currently, this list is mostly limited to packages.  It doesn't have to
be, so this may change.  In reality, besides the packages, there are
quite a few bits of work on Owl build environment, kernel,
documentation, and the facilities we use to run the project.

If something is listed as ASSIGNED, it doesn't mean you shouldn't
offer to do it.  Re-assigning is perfectly fine if it would seem to
help achieve the goal.  (In fact, I really don't expect some people to
complete what they've volunteered for.)


	apache.

[PRIORITY: medium]
Make a determination on the version of Apache to use (Russian Apache
1.3.x with the use of Cyrillic charsets disabled by default vs. 2.0.x).
Use mod_ssl.  Build modules as DSO, only load the safest subset of them
by default.  Make it fail-close on suEXEC.  Clone and maintain a version
of suEXEC more friendly to virtual hosting.


	bison, dialog, diffstat, diffutils, file, hdparm, man-pages.

[PRIORITY: low]
[ASSIGNED: mci@]
Update these to latest releases once in a while.


	coreutils.

[PRIORITY: low]
[ASSIGNED: ldv@]
Package coreutils' versions of kill(1), hostname(1), and usleep(1).
Correct the other packages (util-linux, net-tools, and owl-startup) to
no longer provide these programs.  Enhance installorder.conf and/or
installworld.sh to resolve the conflict on updates of existing systems.


	cpio, tar.

[PRIORITY: medium]
Audit for and deal with:

1. Races when creating archives: whether it may be made to leave the
intended directory tree by moving directories around, whether it may
be made to block on reading a FIFO or device, -- should probably use
O_NOFOLLOW, then fstat().  Refer to the patches to FTS code in glibc
and to mtree, both of which had similar issues.

2. Races when extracting archives: whether it will be possible for an
attacker to place [sym]links into directories being extracted such
that files in them would go to the wrong place, -- for example, when
restoring user home directories from a backup, as root.

[ASSIGNED: ldv@]
3. In tar only: permissions races when extracting archives: between
the calls to open()/mkdir()/mknod(), chmod() and chown(), -- if
chmod() is done before chown(), that would mean that permissions
may be given to the wrong group for a moment and if chown() is done
first it may mean that extra permissions are given to the file's
group for a moment.  The right sequence is open()/mkdir()/mknod()
using safe mode (~077 & mode), then chown(), then chmod().


	cvs.

[PRIORITY: low]
[ASSIGNED: ldv@]
Update to the latest 1.11.x or to 1.12.x.


	dhcp.

[PRIORITY: low]
[ASSIGNED: ldv@]
All of the DHCP suite programs should use /dev/urandom as the only
source of randomness.  The resolver should be either corrected to use
unpredictable query IDs, or dropped in favor of the one in glibc.

[PRIORITY: low]
[ASSIGNED: ldv@]
The DHCP client should be modified to run as a dedicated pseudo-user
and in a chroot jail.  This requires privilege separation within the
client (not easy).


	gdb.

[PRIORITY: medium]
Investigate and deal with fd leaks into traced programs.  (Is this
problem still present with our current version of gdb?)

[PRIORITY: low]
[ASSIGNED: solar@]
Package a tool to trap unaligned accesses on Alpha.


	gettext.

[PRIORITY: low]
[ASSIGNED: exon@]
Update gettext to 0.14.5.

[PRIORITY: low]
[ASSIGNED: exon@]
Split the appropriate files into a gettext-devel subpackage for Fedora
compatibility.


	glibc.

[PRIORITY: medium]
[ASSIGNED: ldv@]
Patch __libc_message() to write to syslog by default (rather than as
a fallback) and when doing so to connect to /dev/log and write there
directly, without utilizing vsyslog(3) (which may use malloc()-family
functions and thus is unsafe to be invoked on a detected malloc
inconsistency).

[PRIORITY: low]
Make mkstemp(3) and friends produce unpredictable filenames (not just
unique).

[PRIORITY: low]
Fix locales to not declare characters with codes 0 to 0x1f and 0x7f to
0x9f as printable unless some really have to be.  Do it better than by
patching localedef(1) as we do now.

[PRIORITY: low]
The above problem also applies to wide character versions of the
locales which are not corrected by our current localedef(1) patch.
Either fix the locales or enhance the localedef(1) patch to also apply
to the wide character versions.  The problem is seen in particular
with the koi8-r locale for characters in the range 0x80 to 0x9f when
translated with mbrtowc() and checked with iswcntrl().  We have to
build Mutt without glibc's wide character functions for that reason.

[PRIORITY: low]
Support an /etc/libc.conf for hardening features such as zeroing out
freed memory.

[PRIORITY: low]
Investigate and deal with snprintf(3) looping and crashing with huge
field widths.


	gnupg.

[PRIORITY: medium]
[ASSIGNED: mci@]
Keep it to latest release.


	john.

[PRIORITY: medium]
[ASSIGNED: solar@]
Update *.chr files, release as 1.7.  (Lots of other items are in a
separate non-public TODO list for just John.)


	libnet, libnids.

[PRIORITY: low]
Update to latest releases.


	mailx.

[PRIORITY: low]
Sync with current OpenBSD.

If we ever add OpenBSD's lockspool, make sure the order in which mailx
obtains fcntl() and dot-locks is compatible with that of Postfix and
procmail.


	man.

[PRIORITY: low]
[ASSIGNED: ldv@]
Allocate a pseudo-user and group for makewhatis, have makewhatis
results go under a separate directory writable by the group.  Provide
a makewhatis cron job.  Don't process cat (preformatted) pages in
makewhatis.


	mtree.

[PRIORITY: low]
Support ext2fs flags.  Optionally don't store and ignore symlink
permissions.  Optionally dereference symlinks.


	mutt.

[PRIORITY: medium]
Extensively test all of the temporary file handling touched by our
patch.  One way to do it is start up mutt under a "strace -fF", then,
reading the patch, make use of every feature the patch touches.  Make
sure that everything works, the temporary files are dealt with safely
(as seen from the strace output), and all of them are removed on exit.

[PRIORITY: low]
[ASSIGNED: jhuuskon@]
Consider enhancements from VVV (http://mutt.org.ua).


	nmap.

[PRIORITY: medium]
[ASSIGNED: mci@]
Update to 3.95+, reviewing post-3.48 patches in ALT Linux's package.


	openssh.

[PRIORITY: medium]
[ASSIGNED: solar@]
Keep OpenSSH to latest release, with our modifications obviously.

[PRIORITY: low]
Support changing expired passwords for the privsep case as well.
Re-enable forwardings if disabled because of a forced password change.
Do PAM session management as root (again).

[PRIORITY: low]
Investigate and solve the SSH-1 sshd crashes on Alpha w/ BWX (EV56+)
for real rather than workaround them (by building deattack.c without
BWX as is done currently), unless this proves to be a CPU bug (which
it might be).


	openssl.

[PRIORITY: low]
Keep OpenSSL to latest in a branch.


	owl-cdrom.

[PRIORITY: low]
Also provide a silo.conf and generic kernel configuration for SPARC.


	owl-dev.

[PRIORITY: low]
[ASSIGNED: mci@]
Migrate to MAKEDEV-C with proper modifications.  Alternatively, if
we'd only support Linux 2.6.x+ by the time, consider using udev:

http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html


	owl-setup.

[PRIORITY: medium]
[ASSIGNED: solar@, croco@]
Once the ncurses/cdk-based user interface is sufficiently tested, make
it the default.

[PRIORITY: medium]
[ASSIGNED: croco@]
With the ncurses UI, default to using cfdisk, but offer plain fdisk as
well.

[PRIORITY: medium]
[ASSIGNED: croco@]
Talk to PAM rather than invoke passwd(1).  With the ncurses UI, display
prompts and messages with the appropriate CDK widgets.  Buffer multiple
subsequent messages like the old passwdlg.c did.


	owl-startup.

[PRIORITY: low]
[ASSIGNED: galaxy@]
Replace all of the RH-derived networking scripts with our own (yet to
be written) or with etcnet:

http://pilot.org.ua/etcnet/

[PRIORITY: low]
[ASSIGNED: galaxy@]
Unmount any tmpfs filesystems prior to invoking swapoff.  Otherwise,
on swapoff, any swapped out data on tmpfs is first loaded into memory
which may be taking a long time or may fail or cause other things to
fail if there's insufficient physical memory available.  In case we'd
be supporting udev, make an exception for /dev.


	pam.

[PRIORITY: low]
Review PAM man pages in OpenPAM (FreeBSD-current) and on other OSes,
most likely import some from OpenPAM (with minor changes for Linux-PAM
where it differs) and correct others.  Currently, the Linux-PAM man
pages are in a really bad shape.


	pam_mktemp.

[PRIORITY: low]
Do error logging.


	pam_passwdqc.

[PRIORITY: low]
(Optionally?) only display the requirements for valid passwords once
rather than before each retry (from William R. Knox).

[PRIORITY: low]
Provide some real stacking examples in the documentation.

[PRIORITY: low]
Support an external configuration file where settings common to uses
of the module by several services could reside.  (If we start using the
"include" directive, that wouldn't be needed for Owl itself any longer.)

[PRIORITY: low]
Support external wordlists and "31337" word mangling.


	patch.

[PRIORITY: low]
Solve the DoS-against-itself on the temporary file.


	perl.

[PRIORITY: medium]
Deal with FC4/RHEL4 compatibility issues.

[PRIORITY: low]
Re-implement temporary file handling in CGI.pm making use of File::Temp.

[PRIORITY: low]
Fix the tests (or the functions they test) such that "make test" will
no longer use /tmp when $TMPDIR is set.  Currently, with Perl 5.8.3-owl1,
3 of the tests fail when /tmp is unavailable, despite $TMPDIR being set.

[PRIORITY: low]
Determine which of the tests result in network accesses (is it just
DNS lookups?) and disable those from within our perl.spec.


	popa3d, scanlogd.

Separate, currently non-public, TODO lists exist.


	postfix.

[PRIORITY: low]
Consider a number of patches and add-ons.

[PRIORITY: medium]
[ASSIGNED: ldv@]
Open PAM sessions for programs run from .forward or LDA such that
resource limits are set.

[PRIORITY: low]
The order of fcntl() and dot-locks is currently compatible with
procmail, but not the Debian policy.  Someone should get either the
Debian policy or both Postfix and procmail corrected.

[PRIORITY: low]
Bug: when updating the chroot jail to reflect changes in system
libraries, our patched postfix-script does not know to remove copies
of library versions which are no longer in the system.


	rpm.

[PRIORITY: medium]
Audit and correct rpm's temporary file handling and its support for
package signature checking.

[PRIORITY: low]
Update to the latest stable 4.3.x or 4.4.x.


	readline.

[PRIORITY: low]
Update to latest release for FC4 compatibility.


	shadow-utils.

[PRIORITY: low]
Sync to the latest (will have to rework the man pages patches).  Try to
feed generic patches upstream.


	SimplePAMApps.

[PRIORITY: low]
login should accept IP addresses rather than hostnames such that it
can log both into wtmp.


	strace.

[PRIORITY: low]
Re-test pipe(2) reporting on Alpha and fix it if it's still incorrect.


	sysklogd.

[PRIORITY: medium]
chown to syslogd (group or user if the group permissions are already
in use) in syslogd itself.

[PRIORITY: low]
In klogd, support new System.map format used starting with recent
2.2.x kernels on Alpha.

[PRIORITY: low]
Migrate to a better alternative for syslogd, retain this package for
klogd.  Most likely go with a clone of Darren Reed's nsyslogd, which
we will likely have to maintain ourselves.


	SysVinit.

[PRIORITY: low]
Keep to latest release.


	telnet.

[PRIORITY: low]
Sync with current OpenBSD.

[PRIORITY: low]
Pass IP addresses to login once it supports that.

[PRIORITY: low]
Re-enable IPv6 in the client once glibc is fixed.


	util-linux.

[PRIORITY: low]
Keep to latest release.


	vixie-cron.

[PRIORITY: low]
In crontab(1), automatically convert input files from DOS linefeeds
whenever needed.  Alternatively, have crond(8) support crontab files
with DOS linefeeds.  (This is starting to become a frequent problem in
virtual hosting environments.)

[PRIORITY: low]
Reject or support long usernames in crontab(1).


	whoson.

[PRIORITY: medium]
[ASSIGNED: ldv@, solar@]
Package whoson, fixing its support for Unix domain sockets to work on
Linux (apparently, it's only been tested on FreeBSD).  Teach Postfix and
popa3d to use whoson.


	xinetd.

[PRIORITY: medium]
Do ident lookups (if enabled) as a dedicated pseudo-user.

[PRIORITY: low]
Develop and migrate to a cleaner replacement, with some limited
configuration file compatibility.


	Owl/build/installworld.sh

[PRIORITY: medium]
Fix installworld.sh to always pick the latest version of a package when
multiple versions are available (please refer to the appropriate XXX
comment in the script).

$Owl: Owl/doc/TODO,v 1.155 2006/02/02 10:11:32 solar Exp $
