I reviewed python-configshell-fb 1.1.fb25-1.1 as checked into focal. This
shouldn't be considered a full audit but rather a quick gauge of
maintainability.
python-configshell-fb provides a python library which is used for building
CLI based user-interfaces. Upstream appears healthy and responsive.
- CVE History:
- None
- No security relevant Build-Depends
- debhelper, dh-python, python3-all, python3-pyparsing, python3-setuptools, python3-six
- pre/post inst/rm scripts
- These are fine - just the auto-generated ones by dh_python3 to
py3compile on postinst and py3clean on prerm
- No init scripts
- No systemd units
- No dbus services
- No setuid binaries
- No binaries in PATH
- No sudo fragments
- No polkit files
- No udev rules
- No unit tests / autopkgtests
- This will make doing any security updates hard to test...
- No cron jobs
- Clean build log
- No processes spawned
- File IO
- Uses files for preferences and logging but these are all parameters to
the library and not hard-coded
- Preferences are saved and restored using pickle which could present a
security issue since this does little sanity checking on formats etc -
however this is done using a file-name provided by the user of the
library and relative to the user's home directory so this is likely
safe - although there is no use of umask() to ensure this file is not
accessible by others so perhaps that at least should be employed
- Logging
- Uses general python format strings etc - this is safe
- No environment variable usage
- No Use of privileged functions
- No Use of cryptography / random number sources etc
- No Use of temp files
- No Use of networking
- No Use of WebKit
- No Use of PolicyKit
Static analysis via bandit and Coverity does not show anything significant
Security team ACK for promoting python-configshell-fb to main however I
would be happier if some unit tests were added so that some testing can be
done for any future updates to ensure regressions are not introduced.
I reviewed python- configshell- fb 1.1.fb25-1.1 as checked into focal. This
shouldn't be considered a full audit but rather a quick gauge of
maintainability.
python- configshell- fb provides a python library which is used for building
CLI based user-interfaces. Upstream appears healthy and responsive.
- CVE History:
- None
- No security relevant Build-Depends
- debhelper, dh-python, python3-all, python3-pyparsing, python3-setuptools, python3-six
- pre/post inst/rm scripts
- These are fine - just the auto-generated ones by dh_python3 to
py3compile on postinst and py3clean on prerm
- No init scripts
- No systemd units
- No dbus services
- No setuid binaries
- No binaries in PATH
- No sudo fragments
- No polkit files
- No udev rules
- No unit tests / autopkgtests
- This will make doing any security updates hard to test...
- No cron jobs
- Clean build log
- No processes spawned
- File IO
- Uses files for preferences and logging but these are all parameters to
the library and not hard-coded
- Preferences are saved and restored using pickle which could present a
security issue since this does little sanity checking on formats etc -
however this is done using a file-name provided by the user of the
library and relative to the user's home directory so this is likely
safe - although there is no use of umask() to ensure this file is not
accessible by others so perhaps that at least should be employed
- Logging
- Uses general python format strings etc - this is safe
- No environment variable usage
- No Use of privileged functions
- No Use of cryptography / random number sources etc
- No Use of temp files
- No Use of networking
- No Use of WebKit
- No Use of PolicyKit
Static analysis via bandit and Coverity does not show anything significant
Security team ACK for promoting python- configshell- fb to main however I
would be happier if some unit tests were added so that some testing can be
done for any future updates to ensure regressions are not introduced.