The things that I am concerned are mostly
On 2026-08-31 12:34 PM, Gordon Messmer wrote:
A number of Fedora packages have adopted a GOT audit test that I
wrote after the xz-utils attack. It looks for signs of ELF namespace
tampering in running processes. I'd like to propose that Fedora
deploy it as a generic test.
I talked to Cristian about that in the CI channel in June, and he
said "it's fine from Fedora-CI technical perspective but needs more
discussion on the layer deeper down". Cristian asked Maxwell G to
review the test, and Maxwell suggested that we discuss it here when I
followed up with him.
https://codeberg.org/gordonmessmer/got-audit-pipeline
https://codeberg.org/gordonmessmer/got-audit
The version of "got-audit" above is a machine-generated port of the
original:
Apart from the codeberg policy violation, I am concerned about the age
of the tool. Would it not have the same issues that python gdb extension
is having or other? Mostly I would like someone with some domain
knowledge to review the implementation, for example from the CMake
perspective I would have multiple complaints.
https://github.com/hugsy/gef-extras/blob/main/scripts/got_audit.py
https://github.com/hugsy/gef/blob/main/gef.py#L10700
As is often the case, the Python GDB extension was great for
prototyping the tool, but it has required a lot of effort to keep it
building from release to release.
Is the trade-off worth it? Can we not work on the "a lot of effort to
keep it building" part? It seems to me that that would have a greater
benefit to the overall ecosystem. Some more details on this would be good.
The generic pipeline should check packages for systemd service units,
start the units if they can be started automatically, and then audit
each PID started by the service. Auditing non-service binaries is out
of scope for the CI test.
Why is it out of scope? To me the implementation against service units
is fragile e.g. on a fresh installation of `mariadb` you would not be
able to just systemctl start it since it needs to be configured first.
My proposal here would be to hook it more generically, and of course I
am biased towards having it as a tmt check plugin. The primary
distinction would be that something/somebody else is in charge of
defining how to start the service or other simple functional tests. I
can work on an example repo to get you started on this.
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
