[MIR] opal-prd

[Adam Conrad]

[ Availability ]
opal-prd has been in universe since xenial

[ Rationale ]
IBM is requesting opal-prd be installed by hw-detect on OpenPower systems to provide "acpid-like" functionality on OpenPower systems.

[ Security ]
I can find no CVEs relating to skiboot or opal-prd, which could mean it's perfect, but probably means it's just not been abused thoroughly by anyone yet. Given a root daemon is involved, it could probably use a quick once-over.

[ Quality ]
skiboot is maintained in Debian by Frederic Bonnard, an IBM employee, has 0 open bugs in Debian, and 0 open bugs in Ubuntu.

opal-prd installs a single daemon, asks no debconf questions, has systemd support, and comes configured correctly out of the box.

[ Dependencies ]
opal-prd has no dependencies outside main.

[ Maintenance ]
skiboot uses dh(1) style packaging, is lintian-clean, and the packaging is pretty clear and simple.

[Mathieu Trudel-Lapierre (cyphermox)]

As discussed, this needs a security review.

Also, it's missing a bug subscriber.

[Emily Ratliff (emilyr)]

Would IBM be willing to provide backported patches in the event a CVE is found in this code base?

[Vasant Hegde (hegdevasant)]

Yes. We (IBM) will try to provide required fixes.

-Vasant

[Mathieu Trudel-Lapierre (cyphermox)]

There's a team subscriber now for the package; has it been acked by the security team yet?

[Emily Ratliff (emilyr)]

The Security Team acks this unreviewed. We reserve the right to perform a security review at a later date. We are operating under the assumptions that 1) IBM will try to provide backported security fixes (per comment #3), 2) Server/Foundations teams will perform testing of the security updates (per email discussion); 3)the opal-prd package is built only for the ppc64el architecture; 4) opal-prd operates on trusted input provided by the Power firmware.

[Andrew Cloke (andrew-cloke)]

Referencing source bug for ease of navigation: https://bugs.launchpad.net/ubuntu-power-systems/+bug/1555904 .

[Manoj Iyer (manjo)]

comment #3 says that IBM will provide necessary patches for this bug, could you please review this bug and post any links to patches that are upstream?

[Vasant Hegde (hegdevasant)]

Manoj,

Comment #3 is in response to #2. In case if there is any CVE reported, then IBM will try to provide necessary fixes.

No additional patch is required to address this bug.

-Vasant

[Mathieu Trudel-Lapierre (cyphermox)]

I did a quick review of the package for the MIR and it looks fine to me; MIR approved.

[Steve Langasek (vorlon)]

Override component to main
skiboot 5.4.3-1 in artful: universe/admin -> main
1 publication overridden.
Override component to main
opal-prd 5.4.3-1 in artful ppc64el: universe/admin/optional/100% -> main
1 publication overridden.