A number of Fedora packages have adopted a GOT audit test that I wrote
after the xz-utils attack. It looks for signs of ELF namespace tampering
in running processes. I'd like to propose that Fedora deploy it as a
generic test.
I talked to Cristian about that in the CI channel in June, and he said
"it's fine from Fedora-CI technical perspective but needs more
discussion on the layer deeper down". Cristian asked Maxwell G to review
the test, and Maxwell suggested that we discuss it here when I followed
up with him.
https://codeberg.org/gordonmessmer/got-audit-pipeline
https://codeberg.org/gordonmessmer/got-audit
The version of "got-audit" above is a machine-generated port of the
original:
https://github.com/hugsy/gef-extras/blob/main/scripts/got_audit.py
https://github.com/hugsy/gef/blob/main/gef.py#L10700
As is often the case, the Python GDB extension was great for prototyping
the tool, but it has required a lot of effort to keep it building from
release to release.
The generic pipeline should check packages for systemd service units,
start the units if they can be started automatically, and then audit
each PID started by the service. Auditing non-service binaries is out of
scope for the CI test.
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
