Package: dracut-core Version: 059-4 Severity: minor Tags: patch Dear Maintainer,
I just got these NEWS:
multipath-tools (0.8.5-2+deb11u1) bullseye-security; urgency=high
This uploaded fixes CVE-2022-41973:
The fix involves switching from /dev/shm to systemd-tmpfiles.
The tmpfs is mounted to /run/multipath.
If you have previously accessed /dev/shm directly in your setup,
please update to the new path to facilitate this change.
-- Tobias Frost <[email protected]> Tue, 27 Dec 2022 09:46:24 +0100
I don't use multipath-tools, and never will. Or any part of that suite.
However:
$ apt info kpartx | grep Source:
Source: multipath-tools
$ apt-cache rdepends --installed kpartx
kpartx
Reverse Depends:
dracut-core
dracut-core
dracut-core
$ apt info dracut-core | grep -e Depends -e Recommends
Depends: cpio, kmod, udev, kpartx, libkmod2 (>= 22~), e2fsprogs, libc6 (>=
2.34)
Recommends: cryptsetup, dmsetup, dmraid, lvm2, mdadm, console-setup,
binutils, systemd, pigz, pkg-config
Odd! Especially given that the only modules that want kpartx (90multipath,
90dmraid):
$ grep -r kpartx
debian/control:Depends: cpio, kmod, udev, kpartx, libkmod2, e2fsprogs,
${shlibs:Depends}, ${misc:Depends}
debian/changelog: * control: add Depends on kpartx Closes: #636549
pkgbuild/dracut.spec:Recommends: kpartx
pkgbuild/dracut.spec:Requires: kpartx
NEWS.md:- install kpartx's 11-dm-parts.rules
test/TEST-14-IMSM/create-root.sh: [ -e "/dev/mapper/$s" ] && kpartx -a -p
p "/dev/mapper/$s"
test/TEST-14-IMSM/create-root.sh: [ -e "/dev/mapper/$s" ] && kpartx -a -p
p "/dev/mapper/$s"
modules.d/90multipath/module-setup.sh: require_binaries kpartx || return 1
modules.d/90multipath/module-setup.sh: kpartx \
modules.d/90multipath/module-setup.sh: 66-kpartx.rules
67-kpartx-compat.rules \
modules.d/90dmraid/dmraid.sh: [ -e "/dev/mapper/$s" ] && kpartx -a
"/dev/mapper/$s" 2>&1 | vinfo
modules.d/90dmraid/module-setup.sh: require_binaries kpartx || return 1
modules.d/90dmraid/module-setup.sh: inst_multiple -o kpartx
modules.d/90dmraid/module-setup.sh: inst_rules 66-kpartx.rules
67-kpartx-compat.rules
Have these check()s:
$ awk '/check\(\)/,/^}/' modules.d/90{multipath,dmraid}/module-setup.sh
check() {
[[ $hostonly ]] || [[ $mount_needs ]] && {
for_each_host_dev_and_slaves is_mpath || return 255
}
# if there's no multipath binary, no go.
require_binaries multipath || return 1
require_binaries kpartx || return 1
return 0
}
check() {
local holder
local dev
# if we don't have dmraid installed on the host system, no point
# in trying to support it in the initramfs.
require_binaries dmraid || return 1
require_binaries kpartx || return 1
[[ $hostonly ]] || [[ $mount_needs ]] && {
for dev in "${!host_fs_types[@]}"; do
[[ ${host_fs_types[$dev]} != *_raid_member ]] && continue
DEVPATH=$(get_devpath_block "$dev")
for holder in "$DEVPATH"/holders/*; do
[[ -e $holder ]] || continue
[[ -e "$holder/dm" ]] && return 0
break
done
done
return 255
}
return 0
}
I.e. they require both their respective binary /and/ kpartx.
multipath is part of multipath-tools and dmraid is part of dmraid.
dmraid is a Recommends:. I don't have it installed. The module doesn't run for
me:
# dracut -f
...
dracut: dracut module 'dmraid' will not be installed, because command
'dmraid' could not be found!
...
I don't want to have kpartx installed, especially if it's full of privesc CVEs.
Please downgrade it to a Recommends:.
Patch attached.
Best,
наб
-- System Information:
Debian Release: 12.0
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: x32 (x86_64)
Foreign Architectures: amd64, i386
Kernel: Linux 6.1.0-2-amd64 (SMP w/2 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages dracut-core depends on:
ii cpio 2.13+dfsg-7.1
ii dracut-core-kpartx [kpartx] 1.0
ii e2fsprogs 1.47.0-2
ii kmod 30+20221128-1
ii libc6 2.36-8
ii libkmod2 30+20221128-1
ii udev 252.6-1
Versions of packages dracut-core recommends:
ii binutils 2.40-2
pn console-setup <none>
pn cryptsetup <none>
pn dmraid <none>
ii dmsetup 2:1.02.185-2
pn lvm2 <none>
pn mdadm <none>
ii pigz 2.6-1
pn pkg-config <none>
ii systemd 252.6-1
dracut-core suggests no packages.
-- no debconf information
From 99f64e5fef6cb677a70c061faef00bd914f16e42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1?= <[email protected]> Date: Sat, 18 Mar 2023 16:24:34 +0100 Subject: [PATCH] d/control: downgrade dracut-core Depends: kpartx to Recommends:. Only required by 90{multipath,dmraid}, accompanying multipath-tools (not listed) and dmraid (in Recommends:) --- debian/control | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/control b/debian/control index 1ef954dd..45128a2a 100644 --- a/debian/control +++ b/debian/control @@ -23,8 +23,8 @@ Description: Initramfs generator using udev Package: dracut-core Architecture: any Multi-Arch: foreign -Recommends: cryptsetup, dmsetup, dmraid, lvm2, mdadm, console-setup, binutils, systemd, pigz, pkg-config -Depends: cpio, kmod, udev, kpartx, libkmod2, e2fsprogs, ${shlibs:Depends}, ${misc:Depends} +Recommends: cryptsetup, kpartx, dmsetup, dmraid, lvm2, mdadm, console-setup, binutils, systemd, pigz, pkg-config +Depends: cpio, kmod, udev, libkmod2, e2fsprogs, ${shlibs:Depends}, ${misc:Depends} Breaks: dracut-network (<< 057+157-2), dracut-live (<< 059-2) Replaces: dracut-network (<< 057+157-2), dracut-live (<< 059-2) Description: dracut is an event driven initramfs infrastructure (core tools) -- 2.39.2
signature.asc
Description: PGP signature
