[MIR] audit (pulls in libprelude)
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
audit (Ubuntu) |
Fix Released
|
Undecided
|
Tyler Hicks | ||
libprelude (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
This is a MIR to bring a portion of binary packages built from the audit source
package into main. The binary packages of interest (some of which are created by the attached debdiff for the audit package) are:
- auditd
- libaudit-common
- libaudit-dev
- libaudit1
- libauparse-dev
- libauparse0
- python-audit
The binary pacakges that may remain in universe are:
- audispd-plugins
Availability:
- Available in universe for all arches
Rationale:
- Discussed as part of the P and Q security catch all blueprints
+ https:/
+ https:/
- libaudit0 is a build dependency of the Debian cron package
+ https:/
- The audit log can already be used by AppArmor
+ http://
- linux-tools perf depends on libaudit-dev
Security:
- One CVE (CVE-2008-1628) in the project's history
- Note that CVEs have been assigned for the kernel audit subsystem, but those
are unrelated to the audit userspace code
- Security risk involved since auditd is a daemon that runs as root
+ Implementing privilege dropping would not be trivial:
http://
- auditd can open up a port and listen for audit messages from remote machines
+ NOTE: This is no longer true as of auditd 1:2.2.2-1ubuntu2, which disabled
the network listener support
+ The default auditd.conf is *not* configured to open a port
+ auditd doesn't create a socket unless tcp_listen_port is set in
auditd.conf (see auditd_
+ The upstream build system does not allow disabling of the networking code
- The audispd-plugins binary package contains functionality to send audit
messages to remote machines but a main inclusion is not being requested for
audispd-plugins
Quality Assurance:
- Basic audit logging works immediately after auditd package installation
- The upstream maintainer is active on the mailing list
+ https:/
- The lastest upstream release was on March 23, 2012
- 1 "low" bug opened against Ubuntu audit source package
+ https:/
- 4 bugs opened against the Debian audit source package
+ 1 important, 2 minor, 1 wishlist
+ http://
- 'make check' tests are enabled in the build
- debian/watch exists
UI Standards:
- The only end-user application is in the system-config-audit binary package,
which is not included in this MIR
Dependencies:
- One build dependency is not in main
+ libprelude-dev binary and source package is in universe
- All external binary dependencies are in in main
Standards Compliance:
- No lintian errors
- 9 overridden lintian warnings due to non-standard file/dir permissions
because config and log files are intentionally installed with restrictive
file permissions due to the security-related nature of the package (see
debian/
Maintenance:
- This is a relatively simple package that seems to be well maintained
upstream and in Debian
- Should not require a dedicated maintainer in Ubuntu
description: | updated |
summary: |
- [MIR] audit + [MIR] audit (pulls in libprelude and maybe libev) |
description: | updated |
description: | updated |
description: | updated |
description: | updated |
Changed in libprelude (Ubuntu): | |
status: | Invalid → New |
no longer affects: | libev (Ubuntu) |
Changed in audit (Ubuntu): | |
status: | Fix Released → New |
Changed in audit (Ubuntu): | |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in libprelude (Ubuntu): | |
assignee: | nobody → Jamie Strandboge (jdstrand) |
As Steve Langasek has previously pointed out[1], the audit source tree includes an embedded copy[2] of libev that is statically links against. If we leave it as-is, we can drop the libev build dependency but that doesn't seem like a clean solution.
1: https:/ /bugs.launchpad .net/ubuntu/ +source/ cron/+bug/ 878155/ comments/ 2 /fedorahosted. org/audit/ browser/ trunk/src/ libev?rev= 698
2: https:/