On 2026-09-07 4:08 AM, Cristian Le via devel wrote:
On 2026-08-31 12:34 PM, Gordon Messmer wrote:
https://codeberg.org/gordonmessmer/got-audit-pipeline
https://codeberg.org/gordonmessmer/got-audit
Apart from the codeberg policy violation, I am concerned about the age
of the tool. Would it not have the same issues that python gdb
extension is having or other? Mostly I would like someone with some
domain knowledge to review the implementation, for example from the
CMake perspective I would have multiple complaints.
I can easily move the repos elsewhere. For the most part I've been using
codeberg because Fedora is adopting Forgejo and Matthew wanted me to
make sure all of my work was functional with Codeberg actions.
"gef" has been a lot of work to keep building because it's a general
purpose tool with a very broad test suite. Changes in gdb and in glibc
have both cause test failures that require updates in "gef" to adapt. I
don't think that will be true of got-audit because its purpose is much
narrower. Less functionality means it's less sensitive to changes in the
platform.
The generic pipeline should check packages for systemd service
units, start the units if they can be started automatically, and
then audit each PID started by the service. Auditing non-service
binaries is out of scope for the CI test.
Why is it out of scope?
The intention is to detect back-doors in services that listen on network
sockets. It's possible that someone might insert malware in software
that doesn't run as a service, but I am not personally as concerned with
that possibility.
To me the implementation against service units is fragile e.g. on a
fresh installation of `mariadb` you would not be able to just
systemctl start it since it needs to be configured first. My proposal
here would be to hook it more generically, and of course I am biased
towards having it as a tmt check plugin. The primary distinction would
be that something/somebody else is in charge of defining how to start
the service or other simple functional tests. I can work on an example
repo to get you started on this.
There are services that may require extra steps to audit, and I'd be
happy to work on tmt tests for cases where the generic test doesn't
work. But it would be nice to get as much coverage as possible, and
address the exceptions as needed, rather than doing every service one by
one.
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
