On Mon, Aug 31, 2026, at 3:34 PM, Gordon Messmer wrote: > A number of Fedora packages have adopted a GOT audit test that I wrote > after the xz-utils attack. It looks for signs of ELF namespace tampering > in running processes. I'd like to propose that Fedora deploy it as a > generic test. > > I talked to Cristian about that in the CI channel in June, and he said > "it's fine from Fedora-CI technical perspective but needs more > discussion on the layer deeper down". Cristian asked Maxwell G to review > the test, and Maxwell suggested that we discuss it here when I followed > up with him.
My instinct is that while it does seem good to say "we have a thing here" in response to the xz attack, in practice that particular vector is probably considered "burned" (i.e. unlikely to be reused in the same way) by the attackers. The times this tool flags a problem will probably be 99% false positives (tool chain bugs, etc). There's quite a whole lot of possible attacks here of which mutating the GOT is just one. Also a core problem in the general case is it's running from the system it's trying to scan, which has all the same problems that antivirus systems have. But on the other hand, it will probably pass 99.9% of the time and so it will come down to measuring its cost over time, if it's pretty cheap and quick, that's probably fine - especially if it does happen to find toolchain bugs. -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
