This patch adds the config script to the package (as done in unstable)
and ensures that it runs at build time. Given this, you can adjust the
config script or the code to report a fatal error if it detects the
insecure connector API.

Ben.

diff -u drbd8-8.0.14/debian/drbd8-source.drbd-Makefile drbd8-8.0.14/debian/drbd8-source.drbd-Makefile
--- drbd8-8.0.14/debian/drbd8-source.drbd-Makefile
+++ drbd8-8.0.14/debian/drbd8-source.drbd-Makefile
@@ -12,0 +12,9 @@
drbd-objs += connector.o cn_queue.o
endif

+# Automatically update config
+$(addprefix $(obj)/,$(drbd-objs)): $(obj)/linux/drbd_config.h
+$(obj)/linux/drbd_config.h: FORCE
+ $(Q)if [ "$(obj)" != "$(src)" ]; then
+ mkdir -p $(@D) &&
+ cp $(src)/linux/drbd_config.h $@;
+ fi
+ cd $(obj) && KDIR=$(objtree) $(src)/../scripts/adjust_drbd_config_h.sh
+.PHONY: FORCE
diff -u drbd8-8.0.14/debian/rules drbd8-8.0.14/debian/rules
--- drbd8-8.0.14/debian/rules
+++ drbd8-8.0.14/debian/rules
@@ -113,7 +113,8 @@
cp debian/drbd8-source.Makefile debian/$(PACKAGE)-source/usr/src/modules/drbd8/Makefile
cp debian/drbd8-source.drbd-Makefile debian/$(PACKAGE)-source/usr/src/modules/drbd8/drbd/Makefile
cp drbd/linux/drbd_config.h debian/$(PACKAGE)-source/usr/src/modules/drbd8
-# cp -a scripts/adjust_drbd_config_h.sh debian/$(PACKAGE)-source/usr/src/modules/drbd/scripts/
+ mkdir debian/$(PACKAGE)-source/usr/src/modules/drbd8/scripts
+ cp scripts/adjust_drbd_config_h.sh debian/$(PACKAGE)-source/usr/src/modules/drbd8/scripts/

# install debian/ files
mkdir -p debian/$(PACKAGE)-source/usr/src/modules/drbd8/debian/
--- END ---

--
Ben Hutchings
Humour is the best antidote to reality.

On Fri, Mar 12, 2010 at 04:52:46AM +0000, Ben Hutchings wrote:
> This patch adds the config script to the package (as done in unstable)
> and ensures that it runs at build time. Given this, you can adjust the
> config script or the code to report a fatal error if it detects the
> insecure connector API.

Thanks Ben, that works great.

My suggestion would then be to add a #warning message if built against
old headers, but allow it to complete anyway. My reasoning is that
we provide prebuilt binaries on lenny, and we can guarantee that those
binaries get fixed (by only signing good builds).

The only people building the modules directly are likely running some
self-maintained kernel. This kernel may or may not be keeping up with
security patches - that we can't control - but we can avoid a
regression in functionality. The drbd build is also currently free of
warnings, so this one should stick out.

Attached is a combined patch that implements this.