I've added a "scan" script that iterates over all of the packages in
Fedora that have service units, and scans each of them. Just under 2/3
start without configuration and can be scanned.
With that, I found just one more set of libraries that had symbol
duplication. And at that point, I think there was enough information
available to try to put in place a general heuristic to minimize the
number of symbols that have to be simply allow-listed.
I've checked the got-audit tool against the compromised library and
confirmed that the back-door is still detected, and I've run the scan
against Fedora 44 and found no alerts (as expected).
https://github.com/gordonmessmer/got-audit
https://github.com/gordonmessmer/maps-audit
https://github.com/gordonmessmer/got-audit-pipeline
https://github.com/gordonmessmer/got-audit-scan
https://copr.fedorainfracloud.org/coprs/gordonmessmer/got-audit/
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
