Review for Source Package: trace-cmd [Summary] MIR team ACK under the constraint to resolve the below listed required TODOs and as much as possible having a look at the recommended TODOs.
Although the package can pass our security check-list, trace-cmd itself runs as root to setup events in ftrace kernel subsystem. This combined with the use of setuid/setgid in trace-record.c (change_user()) and extensive use of malloc/sprintf, I think are good enough reasons for a sec review. This does need a security review, so I'll assign ubuntu-security, after the required TODOs are addressed. List of specific binary packages to be promoted to main: trace-cmd, libtracecmd1,libtracecmd-dev Specific binary packages built, but NOT to be promoted to main:<None> Notes: Required TODOs: 1. Other dependies to MIR: a. libtracefs - https://bugs.launchpad.net/ubuntu/+source/libtracefs/+bug/2051925 b. libtraceevent - https://bugs.launchpad.net/ubuntu/+source/libtraceevent/+bug/2051916 2. No tests during build, please add tests. 3. No autopackage tests present. This TODO incorporates Christain's feedback (comment #2) "but on this level we should require to set up some good autopkgtests that help us to ensure this full stack is really working well on e.g. changed kernels." Please add autopackage tests. Recommended TODOs: 4. The output of 'lintian --pendatic --tag-display-limit 0' yields many warnings some of them segfaults. Not sure if this is a problem of the package or troff but please take a look. (https://pastebin.ubuntu.com/p/JYGrJ7wnJz/) 5. There a few warning (unused return values) during build 6. The package should get a team bug subscriber before being promoted [Rationale, Duplication and Ownership] There is no other package in main providing the same functionality. Foundations team is committed to own long term maintenance of this package. The rationale given in the report seems valid and useful for Ubuntu [Dependencies] OK: - no -dev/-debug/-doc packages that need exclusion - No dependencies in main that are only superficially tested requiring more tests now. Problems: - other Dependencies to MIR due to this [Embedded sources and static linking] OK: - no embedded source present - no static linking - does not have unexpected Built-Using entries OK: - not a go package, no extra constraints to consider in that regard - not a rust package, no extra constraints to consider in that regard Problems: None [Security] OK: - history of CVEs does not look concerning - does not run a deamon as root - does not use webkit1,2 - does not use lib*v8 directly - does not parse data formats (files [images, video, audio, xml, json, asn.1], network packets, structures, ...) from an untrusted source. - does not expose any external endpoint (port/socket/... or similar) - does not process arbitrary web content - does not use centralized online accounts - does not integrate arbitrary javascript into the desktop - does not deal with system authentication (eg, pam), etc) - does not deal with security attestation (secure boot, tpm, signatures) - does not deal with cryptography (en-/decryption, certificates, signing, ...) Problems: - this does not make appropriate (for its exposure) use of established risk mitigation features (dropping permissions, using temporary environments, restricted users/groups, seccomp, systemd isolation features, apparmor, ...) [Common blockers] OK: - does not FTBFS currently - This does not need special HW for build or test - no new python2 dependency Problems: - does not have a test suite that runs at build time - does not have a non-trivial test suite that runs as autopkgtest [Packaging red flags] OK: - Ubuntu does not carry a delta - symbols tracking is in place. - debian/watch is present and looks ok (if needed, e.g. non-native) - Upstream update history is good - Debian/Ubuntu update history is slow - the current release is packaged - promoting this does not seem to cause issues for MOTUs that so far maintained the package - debian/rules is rather clean - It is not on the lto-disabled list Problems: - massive Lintian warnings - https://pastebin.ubuntu.com/p/JYGrJ7wnJz/ [Upstream red flags] OK: - no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests) - no important open bugs (crashers, etc) in Debian or Ubuntu - no dependency on webkit, qtwebkit, seed or libgoa-* - not part of the UI for extra checks - no translation present, but none needed for this case (user visible)? Problems: - a few warnings during the build about ignoring return values - heavy use of malloc and sprintf - use of setuid/setgid ** Changed in: trace-cmd (Ubuntu) Status: New => Incomplete ** Changed in: trace-cmd (Ubuntu) Assignee: Ioanna Alifieraki (joalif) => (unassigned) ** Changed in: trace-cmd (Ubuntu) Assignee: (unassigned) => Paul Mars (upils) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2051850 Title: [MIR] trace-cmd To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/trace-cmd/+bug/2051850/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
