I reviewed thunderbolt-tools version 0.9.3-1 as checked into bionic. This
shouldn't be considered a full security audit but rather a quick gauge of
maintainability.
- No CVEs in our database
- thunderbolt-tools provides a simple interface to authorize thunderbolt
devices that are being added to a computer, since thunderbolt devices
have immense control over the safety of the system
- Build-Depends: debhelper, libboost-dev, libboost-filesystem-dev,
libboost-program-options-dev, cmake, pkg-config, udev, txt2tags
- Does not daemonize; udev hook scripts are used
- No pre/post inst/rm scripts
- No initscript / systemd unit files
- No DBus services
- No setuid files
- /usr/bin/tbtadm added to the PATH
- No sudo fragments
- udev rules -- appear to be configured for works-by-default behaviour,
some examples on how to configure for authorization-required would be
nice
- No tests, a bit unfortunate
- No cronjobs
- Clean build logs
- No subprocesses spawned
- C++ RAII memory management
- File IO done via RAII-C++ classes, not exactly obvious when it happens
- Some C++ exceptions, some C++ iostream
- No environment variable use
- The only privileged operations are file writes
- No cryptography
- No network connections
- No privileged portions of code
- No temporary files
- No WebKit
- No JavaScript
- No PolicyKit
- Clean cppcheck
thunderbolt-tools is short and sweet authorization tool. It's written in
modern C++, looks careful, and shouldn't be an undue maintenance burden.
It uses std::random_device for security uses -- I believe this is safe but
direct use of getrandom(2) would not have questions about underlying C++
library implementation choices.
Security team ACK for promoting thunderbolt-tools to main once the extra
udev configuration file is sorted out.
Thanks
** Changed in: thunderbolt-tools (Ubuntu)
Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1748157
Title:
[MIR] thunderbolt-tools
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/thunderbolt-tools/+bug/1748157/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
