TODO: Review for Source Package: src:rust-ntpd
[Summary]
`rust-ntpd` is a memory-safe Rust implementation of the Network Time Protocol.
The
package offers both client and server modes but enables only client-mode by
default.
Ubuntu will adopt ntpd-rs as the default time synchronization client and
server, eventually
replacing chrony, linuxptp and gpsd. See
https://discourse.ubuntu.com/t/ntpd-rs-its-about-time/79154
MIR team ACK.
This does need a security review, so I'll assign ubuntu-security
List of specific binary packages to be promoted to main: bin:ntpd-rs,
bin:ntpd-rs-metrics
Specific binary packages built, but NOT to be promoted to main: none
Notes:
None.
Required TODOs:
None.
Recommended TODOs:
#0 The package should get a team bug subscriber before being promoted
#1 The build-log shows quite many build warnings. Consider investigating/fixing
them.
[Rationale, Duplication and Ownership]
OK:
- There is no other package in main providing the same functionality.
- A team is committed to own long term maintenance of this package.
- The rationale given in the report seems valid and useful for Ubuntu
[Dependencies]
OK:
- no other runtime Dependencies to MIR due to this
- no other build-time Dependencies with active code in the final binaries to
MIR due to this
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring more
tests now.
Problems: None
[Embedded sources and static linking]
OK:
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- Rust package that has all dependencies vendored. It does neither
have *Built-Using (after build). Nor does the build log indicate
built-in sources that are missed to be reported as Built-Using.
=> Only the rust toolchain is listed in Static-Built-Using:
cargo:Built-Using=
cargo:Static-Built-Using=rust-defaults (= 1.97.1ubuntu1)
cargo:X-Cargo-Built-Using?=rust-defaults (= 1.97.1ubuntu1)
- rust package using dh_cargo (dh ... --buildsystem cargo)
- Includes vendored code, the package has documented how to refresh this code
at debian/README.source
Problems: None
[Security]
OK:
- does not run a daemon as root
=> debian/ntpd-rs.service runs as User=ntpd-rs/Group=ntpd-rs
- does not use webkit1,2
- does not use lib*v8 directly
- does not parse data formats (files [images, video, audio,
xml, json, asn.1], network packets, structures, ...) from
an untrusted source.
=> parses NTP v4 and v5 packets from the network
- does not expose any external endpoint (port/socket/... or similar)
=> works in client-only mode by default, can serve NTP is explicitly
configured in ntp.toml
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)
=> The Network Time Security (NTS) extension uses openssl (see
debian/patches/openssl-crypto.patch)
- this makes appropriate (for its exposure) use of established risk
mitigation features (dropping permissions, using temporary environments,
restricted users/groups, seccomp, systemd isolation features,
apparmor, ...)
=> AppArmor profile present in debian/usr.bin.ntp-daemon
Problems:
- history of CVEs does look concerning
=> The CVE history is significant
(https://github.com/pendulum-project/ntpd-rs/security)
[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
- test suite fails will fail the build upon error.
- does have a non-trivial test suite that runs as autopkgtest
- This does not need special HW for build or test
- if a non-trivial test on this level does not make sense (the lib alone
is only doing rather simple things), is the overall solution (app+libs)
extensively covered i.e. via end to end autopkgtest ?
- no new python2 dependency
- not a Python package
- not a Go package
Problems: None
[Packaging red flags]
OK:
- Ubuntu does carry a delta, but it is reasonable and maintenance under control
- symbols tracking not applicable for this kind of code.
- debian/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is good
- Debian/Ubuntu update history is good
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far maintained
the package
- no massive Lintian warnings
- debian/rules is rather clean
- It is not on the lto-disabled list
- debian/control defines a correct Maintainer field
Problems: None
[Upstream red flags]
OK:
- no Errors/warnings during the build
=> A lot of warnings seen in the build logs
- no incautious use of malloc/sprintf (the language has no direct MM)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside tests)
- no use of user 'nobody' outside of tests
- no use of setuid / setgid
- no important open bugs (crashers, etc) in Debian or Ubuntu
=> server-mode bug:
https://bugs.launchpad.net/ubuntu/+source/rust-ntpd/+bug/2162124
- no dependency on webkit, qtwebkit or libseed
- not part of the UI for extra checks
- no translation present, but none needed for this case (user visible)?
Problems:
- Errors/warnings during the build
=> A lot of warnings seen in the build logs
** Changed in: rust-ntpd (Ubuntu)
Assignee: Pushkar Kulkarni (pushkarnk) => Ubuntu Security Team
(ubuntu-security)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166406
Title:
[MIR] rust-ntpd
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rust-ntpd/+bug/2166406/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
