Re: [PATCH] Disallow use of DES encryption functions in new programs.

[Florian Weimer <fweimer@redhat.com>]

On 06/25/2018 03:43 PM, Florian Weimer wrote:
> diff --git a/conform/data/stdlib.h-data b/conform/data/stdlib.h-data
> index d8fcccc2fb..6913828196 100644
> --- a/conform/data/stdlib.h-data
> +++ b/conform/data/stdlib.h-data
> @@ -149,9 +149,6 @@ function {unsigned short int*} seed48 (unsigned short int[3])
>   #if !defined ISO && !defined ISO99 && !defined ISO11 && !defined POSIX && !defined XPG4 && !defined XPG42 && !defined UNIX98
>   function int setenv (const char*, const char*, int)
>   #endif
> -#if !defined ISO && !defined ISO99 && !defined ISO11 && !defined POSIX && !defined POSIX2008
> -function void setkey (const char*)
> -#endif
>   #if !defined ISO && !defined ISO99 && !defined ISO11 && !defined XPG4 && !defined POSIX && !defined POSIX2008
>   function {char*} setstate (char*)
>   #endif
> diff --git a/conform/data/unistd.h-data b/conform/data/unistd.h-data
> index ddf4f25132..aa070528e8 100644
> --- a/conform/data/unistd.h-data
> +++ b/conform/data/unistd.h-data
> @@ -437,9 +437,6 @@ function int chroot (const char*)
>   function int chown (const char*, uid_t, gid_t)
>   function int close (int)
>   function size_t confstr (int, char*, size_t)
> -#if !defined POSIX && !defined POSIX2008
> -function {char*} crypt (const char*, const char*)
> -#endif
>   #if defined XPG4 || defined XPG42 || defined UNIX98
>   function {char*} ctermid (char*)
>   function {char*} cuserid (char*)
> @@ -449,9 +446,6 @@ allow cuserid
>   #endif
>   function int dup (int)
>   function int dup2 (int, int)
> -#if !defined POSIX && !defined POSIX2008
> -function void encrypt (char[64], int)
> -#endif
>   function int execl (const char*, const char*, ...)
>   function int execle (const char*, const char*, ...)
>   function int execlp (const char*, const char*, ...)

Joseph, do you think the above changes are correct?  Or was crypt a 
non-optional part of any of the standards at one point?

There is not much we can do about encrypt and setkey, though, if it was 
mandatory.  We really want to get rid of that.

Thanks,
Florian