[MIR] thin-provisioning-tools

[Andreas Hasenack]

[Availability]
The package is available in eoan universe (https://launchpad.net/ubuntu/+source/thin-provisioning-tools/0.7.6-2.1ubuntu1) and builds for amd64, arm64, armhf, i386, ppc64el, s390x.

[Rationale]
The package is useful as a Recommends of lvm2, which is in main. See bug #1657646, where confusion arises because it's possible to create thin pools without this package, but not activate them because a binary called thin_check is needed, and that is only available in thin-provisioning-tools. See https://bugs.launchpad.net/ubuntu/+source/lvm2/+bug/1657646/comments/13 and, for a similar case involving cache pools, https://bugs.launchpad.net/ubuntu/+source/lvm2/+bug/1657646/comments/21.

[Security]
There are no CVE hits on mitre.

Query for "site:www.openwall.com/lists/oss-security thin-provisioning-tools" is empty.

Ubuntu CVE tracker is empty. I also searched for "lvm" in main and universe.

No suid executables.

No services are installed.

[Quality assurance]
No debconf questions.

LVM2 tools use the new thin provisioning tools without further configuration.

There are no open Ubuntu bugs.

One very old (2014) open bug in debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749328

Upstream URL seems incorrect in d/control:
https://gitlab.com/debian-lvm/thin-provisioning-tools is a 404 nowadays

New upstream seems to be https://github.com/jthornber/thin-provisioning-tools

I verified the release tarball from Debian and its hash matches the tarball downloaded from the above github repo.

Upstream issues: https://github.com/jthornber/thin-provisioning-tools/issues
Upstream PRs: https://github.com/jthornber/thin-provisioning-tools/pulls
Upstream release cadence: https://github.com/jthornber/thin-provisioning-tools/releases

I don't see critical bugs opened upstream or in debian.

Debian package tracker: https://tracker.debian.org/pkg/thin-provisioning-tools
- packaging could use some love and be updated. Standards is old, no manpage for the specific tool that is provided, url in d/control should be updated
- updates in debian seem frequent enough. Debian just doesn't have the latest 0.8 tree yet, but is up-to-date in the 0.7 one.

Test suite is run at package build time, and there are no DEP8 tests.

There is no d/watch file.

Lintian output confirms the packaging could use some love:
$ lintian -I --pedantic
P: thin-provisioning-tools source: file-contains-trailing-whitespace debian/changelog (line 145)
P: thin-provisioning-tools source: package-uses-old-debhelper-compat-version 10
W: thin-provisioning-tools source: package-needs-versioned-debhelper-build-depends 10
W: thin-provisioning-tools source: useless-autoreconf-build-depends dh-autoreconf
P: thin-provisioning-tools source: no-homepage-field
P: thin-provisioning-tools source: insecure-copyright-format-uri http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
W: thin-provisioning-tools source: ancient-standards-version 3.9.5 (released 2013-10-28) (current is 4.3.0)
I: thin-provisioning-tools source: testsuite-autopkgtest-missing
I: thin-provisioning-tools source: debian-watch-file-is-missing
W: thin-provisioning-tools: manpage-has-errors-from-man usr/share/man/man8/cache_check.8.gz 1: warning: macro '"' not defined
W: thin-provisioning-tools: manpage-has-errors-from-man usr/share/man/man8/cache_dump.8.gz 1: warning: macro '"' not defined
W: thin-provisioning-tools: manpage-has-errors-from-man usr/share/man/man8/cache_metadata_size.8.gz 1: warning: macro '"' not defined
W: thin-provisioning-tools: manpage-has-errors-from-man ... use --no-tag-display-limit to see all (or pipe to a file/program)
I: thin-provisioning-tools: spelling-error-in-manpage usr/share/man/man8/era_dump.8.gz formated formatted
I: thin-provisioning-tools: spelling-error-in-manpage usr/share/man/man8/era_dump.8.gz writeing writing
I: thin-provisioning-tools: spelling-error-in-manpage usr/share/man/man8/thin_dump.8.gz formated formatted
I: thin-provisioning-tools: spelling-error-in-manpage ... use --no-tag-display-limit to see all (or pipe to a file/program)
W: thin-provisioning-tools: binary-without-manpage usr/sbin/pdata_tools

There are two build-dependencies from Universe, but they are used only for the test suite:
 libgtest-dev,
 google-mock,
I confirmed this by rebuilding the package with DEB_BUILD_OPTIONS=nocheck and removing these build-deps, and the package built fine with the same Depends as the copy from the archive.

No python2 or other deprecated build-deps.

[UI standards]
There is no i18n support.

[Dependencies]
All runtime dependencies are in main. There are build dependencies that are in universe, but these are used for the test suite only.

[Standards compliance]
d/rules is very simple
The packaging overall could use some modernization, see lintian output in an earlier section. Not too hard to update (watch file, d/control updates, standards-version).
File placement in terms of FHS is fine.

[Maintenance]
TBD who will maintain this package.

[Background information]
None at this time.

[Christian Ehrhardt  (paelzer)]

Thanks for the thorough pre-check and report Andreas.

Here my MIR review:

[Summary]
The package seems reasonable maintained and also ok in general.
The only security exposure that came up is that it is read/writing data formats.
That alone would not yet make it very security sensitive.
But the fact that this is - if at all - used is used in more enterpris'y context
makes that data write/read important.
I think the general rule applies here to be on the side of caution - therefore
I'd ask for a security review of it.

While that is going on:
1. please sort out the future Team subscriber as well.
   Even if subscribing late, please state here who it will be once known.

2. Personally I don't need d/watch files too much, but the process requires it.
   Please could you check to get a d/watch file added against the github
   project?

--- Detail ---

[Duplication]
There is no duplicate function in the Archive

[Embedded sources and static linking]
OK are:
- no embedded sources
- no static linking
- no golang

[Security]
OK are:
- no history of CVEs
- does not use webkit1,2
- does not use lib*v8 directly
- does not processes arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not run a daemon as root
- does not open a port

Although it
- does parse data formats (mostly read/write on disk metadata)

[Common blockers]
OK are:
- no FTBFS currently
- test suite runs at build time
- no python code to check

Although it:
- does not yet have a team bug subscriber
  Before this can be completed someone has to step up, given that LVM2 is
  Foundations and the last uploads/modifications as well I assume they will
  take it.
  But that has to happen before promotion.

[Packaging red flags]
OK are:
- Ubuntu has a Delta for a Ubuntu specific (as needed) build error (ok)
- no libraries shipped
- update history is nothe most active one but seems ok
  - Debian maintenance is a bit unclear (see description), but active enough
- no MOTU only case
- Lintian warnings are a lot (cleanup would be nice), but no critical ones
- d/rules is rather clean
- not using Built-Using
- no golang

Although it:
- does not have a watch file
- the current release is not yet packaged, but that is just 3 weeks old
  (ok for now)

[Upstream red flags]
- a few "may be used uninitialized" and "suggest explicit braces" warnign,
  but no error
 use of malloc/sprintf seems ok
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user "nobody"
- no setuid
- no known critical bugs
  - there is one data corruption upstream, but badly filed and lack of info
- no Dependency on webkit, qtwebkit, seed or libgoa-*
- no Embedded source copies
- not part of the scope for the Unity Dash and its privacy settings

[Andreas Hasenack (ahasenack)]

PR for the watch file on salsa: https://salsa.debian.org/lvm-team/thin-provisioning-tools/merge_requests/1

Salsa is a bit behind from debian even, as the last upload was an NMU FTBFS fix.

[Joshua Powers (powersj)]

ubuntu-server is now subscribed to bugs

[Steve Beattie (sbeattie)]

I reviewed thin-provisioning-tools 0.7.6-2.1ubuntu1 as checked
into eoan. This shouldn't be considered a full audit but rather a
quick gauge of maintainability.

thin-provisioning-tools is a set of tools for managing meta-data for
the Linux kernel's device-mapper thin target. It is not entirely clear
what the threat model is here, in that this is a series of command line
tools to manage thin dm volumes, and is expected to be run by an
administrator (no setuid, no calls to sudo). Orchestration tools might
wrap thin-provisioning-tools would want to take care to sanitize input
that is eventually passed on to these tools, but that is out of the
scope of this audit.

- CVE History: No CVEs found.
- thin-provisioning-tools buiild depends on libaio-dev, libexpat1-dev,
  and libboost-dev
  - libexpat1 is both good and bad, as it has had a less than
    stellar security history, but is better than rolling one's own
    XML implementation.
- pre/post inst/rm scripts?
  - The postinst triggers update-initramfs. There is no postrm,
    so does not do this, but probably should.
- No init scripts or systemd units.
- No dbus services.
- No setuid binaries.
- thin-provisioning-tools provides one primary binary
  /usr/sbin/pdata_tools that is invoked in different ways by symlinked
  entries in /usr/sbin. Man pages are provided for every symlink.
- No sudo fragments.
- No udev rules.
- Unit tests are run during the build. It's unclear how much coverage
  this provides, but it's a non-trivial amount.
- No autopkgtests are performed. Functional tests are provided in the
  upstream, but not used by autopkgtests. This is likely due to
  dependencies on chezscheme (in archive) and thunderchez (not
  packaged); the latter could possibly be vendor packaged, as the
  functional tests run successfully if they are available
  (with CHEZSCHEMELIBDIRS="PATH/TO/thunderchez/:$PWD/functional-tests" make test)
  These tests may or may not be able to run at build time, but for sure
  in an autopkgtest environment. Unclear how much coverage is provided,
  but they do at least minimally appear to exercise all of the command
  variations.
- No cron jobs.
- Build logs:
  - Some dh provided configure options ignored
  - 3 compiler warnings issued, 1 potential uninitialized value, and two
    warnings about explicitly using braces to avoid ambiguous ‘else’
    situations. Mostly clean build.
  - No lintian failures, no significant lintian warnings, mostly just
    indications of lack of packager(s) attention.
- Does not appear to spawn external processes (except for debugging
  and in testsuites).
- Memory management is generally performed okay. Errors values returned
  by copying/writing operations are not always checked.
- For file handling, generally, the tools take the dm device to
  operate on as a command line argument.
  - Configuration information for import is in an XML format.
  - One possible issue is that the file_utils::open_file() which
    underlies the block file open/creation interface defaults to
    mode 0666 without any way to override it.
- Generally uses cout for logging output errors.
- No use of environment variables.
- Only privileged function used is ioctl,...

[Christian Ehrhardt  (paelzer)]

This is ready and IMHO no FF violation.
MP is at https://code.launchpad.net/~paelzer/ubuntu/+source/lvm2/+git/lvm2/+merge/372393

[Christian Ehrhardt  (paelzer)]

Ok, after first migrating to -release without sshowing up at all it is now showing up in component mismatches correctly.
Since the MIR (here) is approved I'm just waiting for an AA to resolve that.

[Matthias Klose (doko)]

Override component to main
thin-provisioning-tools 0.7.6-2.1ubuntu1 in eoan: universe/misc -> main
thin-provisioning-tools 0.7.6-2.1ubuntu1 in eoan amd64: universe/admin/optional/100% -> main
thin-provisioning-tools 0.7.6-2.1ubuntu1 in eoan arm64: universe/admin/optional/100% -> main
thin-provisioning-tools 0.7.6-2.1ubuntu1 in eoan armhf: universe/admin/optional/100% -> main
thin-provisioning-tools 0.7.6-2.1ubuntu1 in eoan i386: universe/admin/optional/100% -> main
thin-provisioning-tools 0.7.6-2.1ubuntu1 in eoan ppc64el: universe/admin/optional/100% -> main
thin-provisioning-tools 0.7.6-2.1ubuntu1 in eoan s390x: universe/admin/optional/100% -> main
7 publications overridden.