I reviewed thunderbolt-tools version 0.9.3-1 as checked into bionic. This
shouldn't be considered a full security audit but rather a quick gauge of

- No CVEs in our database
- thunderbolt-tools provides a simple interface to authorize thunderbolt 
  devices that are being added to a computer, since thunderbolt devices 
  have immense control over the safety of the system
- Build-Depends: debhelper, libboost-dev, libboost-filesystem-dev, 
  libboost-program-options-dev, cmake, pkg-config, udev, txt2tags
- Does not daemonize; udev hook scripts are used
- No pre/post inst/rm scripts
- No initscript / systemd unit files
- No DBus services
- No setuid files
- /usr/bin/tbtadm added to the PATH
- No sudo fragments
- udev rules -- appear to be configured for works-by-default behaviour, 
  some examples on how to configure for authorization-required would be 
- No tests, a bit unfortunate
- No cronjobs
- Clean build logs

- No subprocesses spawned
- C++ RAII memory management
- File IO done via RAII-C++ classes, not exactly obvious when it happens
- Some C++ exceptions, some C++ iostream
- No environment variable use
- The only privileged operations are file writes
- No cryptography
- No network connections
- No privileged portions of code
- No temporary files
- No WebKit
- No JavaScript
- No PolicyKit
- Clean cppcheck

thunderbolt-tools is short and sweet authorization tool. It's written in 
modern C++, looks careful, and shouldn't be an undue maintenance burden.

It uses std::random_device for security uses -- I believe this is safe but
direct use of getrandom(2) would not have questions about underlying C++ 
library implementation choices.

Security team ACK for promoting thunderbolt-tools to main once the extra 
udev configuration file is sorted out.


** Changed in: thunderbolt-tools (Ubuntu)
     Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)

You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

   [MIR] thunderbolt-tools

To manage notifications about this bug go to:

ubuntu-bugs mailing list

Reply via email to