Not adding anything, I just realize that I tend to write subjects that
aren't meaningful without context. Perhaps more context in the subject
will invite more comments.
On 2026-08-31 12:34 PM, Gordon Messmer wrote:
A number of Fedora packages have adopted a GOT audit test that I wrote
after the xz-utils attack. It looks for signs of ELF namespace
tampering in running processes. I'd like to propose that Fedora deploy
it as a generic test.
I talked to Cristian about that in the CI channel in June, and he said
"it's fine from Fedora-CI technical perspective but needs more
discussion on the layer deeper down". Cristian asked Maxwell G to
review the test, and Maxwell suggested that we discuss it here when I
followed up with him.
https://codeberg.org/gordonmessmer/got-audit-pipeline
https://codeberg.org/gordonmessmer/got-audit
The version of "got-audit" above is a machine-generated port of the
original:
https://github.com/hugsy/gef-extras/blob/main/scripts/got_audit.py
https://github.com/hugsy/gef/blob/main/gef.py#L10700
As is often the case, the Python GDB extension was great for
prototyping the tool, but it has required a lot of effort to keep it
building from release to release.
The generic pipeline should check packages for systemd service units,
start the units if they can be started automatically, and then audit
each PID started by the service. Auditing non-service binaries is out
of scope for the CI test.
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
