[MIR] wsl-pro-service
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
wsl-pro-service (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Focal |
New
|
Undecided
|
Unassigned | ||
Jammy |
New
|
Undecided
|
Unassigned | ||
Noble |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[Availability]
The package wsl-pro-service is already available in Ubuntu universe.
The package wsl-pro-service build for the architectures it is designed to work on.
It currently builds and works for architectures: amd64, arm64, armhf, ppc64el, riscv64, s390x
Link to package https:/
[Rationale]
Ubuntu Pro for WSL is a set of applications to manage Ubuntu WSL instances, grant them Pro status, orchestrate instances from Landscape and manage their lifecycle. Wsl-pro-service serves as a bridge between the agent running on Windows and Ubuntu instances. It controls the Pro and Landscape status.
The package wsl-pro-service is required to be in main to seed it by default on WSL images.
The package wsl-pro-service will generally be useful for corporate users.
No package in main or universe currently offers these capabilities.
The target release is all the LTS releases from 20.04 onwards.
[Security]
This is a new software developed and maintained by Canonical. It has no security history.
It is a new software and no CVEs/security issues in this software in the past.
- no `suid` or `sgid` binaries
- The package installs a systemd service called wsl-pro-service
- It installs a service in /usr/libexec/
- Packages does not open privileged ports (ports < 1024)
- Packages does not contain extensions to security-sensitive software
- Communication between wsl-pro-service and the agent running on Windows is done over gRPC.
- Security has been kept in mind and common isolation/
*This requires a security review.*
[Quality assurance - function/usage]
The package works well right after installation.
[Quality assurance - maintenance]
The Ubuntu Desktop team (~desktop-packages) maintains this package. It doesn’t have any long-term and critical, open bugs:
- https:/
- https:/
[Quality assurance - testing]
There is a comprehensive, non-trivial, testsuite. The testsuite includes integration and functional tests.
The testsuite runs at build time. The branch coverage is over 88%:
- https:/
- https:/
The same test suite runs as autopkgtest. It is passing on all supported architectures. Links to test logs:
- https:/
Upstream CI also includes code sanity checks (golangci-lint, including gosec) and vulnerability scanning (govulneck).
[Quality assurance - packaging]
- There is no debian/watch because wsl-pro-service is a native package.
- debian/control defines a correct Maintainer field:
- Maintainer: Ubuntu Developers <email address hidden>
This package does not yield massive lintian Warnings, Errors
```
W: wsl-pro-service: no-manual-page [usr/libexec/
```
Full output from `lintian --pedantic`:
```
W: wsl-pro-service: no-manual-page [usr/libexec/
```
- Lintian overrides are not present.
- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies
- The package will be installed by default but does not ask debconf questions.
Packaging and build is easy:
- https:/
[UI standards]
Application is not end-user facing. However some strings are translatable and used for error messages via standard intltool/gettext or similar build and runtime internationaliz
The system for internationaliz
[Dependencies]
No further depends or recommends dependencies that are not yet in main.
[Standards compliance]
- This package correctly follows FHS
- This package violates Debian Policy. It vendorizes various Go libraries (in vendor/). We are maintaining them up to date with dependabot in our upstream CI. The Go part is covered by the govulncheck security scanning on the Go version we are depending on and its vendored dependency.
[Maintenance/Owner]
- The owning team will be desktop-packages and I have their acknowledgement for that commitment
- The team desktop-packages is subscribed.
- The team desktop-packages is aware of the implications by a static build and commits to test no-change-rebuilds and to fix any issues found for the lifetime of the release (including ESM).
- The team desktop-packages is aware of the implications of vendored code and (as alerted by the security team) commits to provide updates to the security team for any affected vendored code for the lifetime of the release (including ESM).
[Background information]
- The Package description explains the package well.
- Upstream Name is wsl-pro-service.
- Link to upstream project https:/
Changed in wsl-pro-service (Ubuntu): | |
assignee: | nobody → Lukas Märdian (slyon) |
tags: | added: sec-3829 |
Review for Source Package: wsl-pro-service
The package is only available on Noble so far, so this review only applies to the Noble version. But I've created bug targets for Focal+ LTS releases as requested, to track future MIR process on the backports.
[Summary]
Wsl-pro-service serves as a bridge between the WSL agent running on Windows
and Ubuntu instances. It controls the Pro and Landscape status. The MIR was
very nicely prepared and the package is in an overall good shapre, but
MIR team ACK (with some recommended TODOs)
This does need a security review
List of specific binary packages to be promoted to main: wsl-pro-service
Specific binary packages built, but NOT to be promoted to main: <None>
Notes:
#0 This needs security review, due to statically built vendored dependencies,
parsing JSON & gRPC data over a network socket and running a daemon as root.
#1 It depends on centralized "Ubuntu Pro" online accounts
#2 The upstream release process is a bit intransparent (no releases tagged
on github) and it only saw 2 uploads into Ubuntu so far, so does not have
a long track record.
Required TODOs:
- None
Recommended TODOs: notice- file-for- apache- license [vendor/ google. golang. org/grpc/ notice- file-for- apache- license [vendor/ gopkg.in/ yaml.v3/ NOTICE]
#3 Please investigate those lintian errors:
- E: wsl-pro-service source: missing-
- E: wsl-pro-service source: missing-
#4 Please investigate this build-time warning:
- dpkg-gencontrol: warning: Built-Using field of package wsl-pro-service: substitution variable ${misc:Built-Using} used, but is not defined
[Rationale, Duplication and Ownership]
There is no other package in main providing the same functionality.
A team is committed to own long term maintenance of this package. (~desktop-packages)
The rationale given in the report seems valid and useful for Ubuntu (WSL)
[Dependencies]
OK:
- no other Dependencies to MIR due to this
- SRCPKG checked with `check-mir`
- all dependencies can be found in `seeded-in-ubuntu` (already in main)
- none of the (potentially auto-generated) dependencies (Depends
and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
more tests now.
Problems: None
[Embedded sources and static linking] /github. com/canonical/ ubuntu- pro-for- wsl/blob/ main/wsl- pro-service/ debian/ update- internal- dependencies
OK:
- Go Package that follows the Debian Go packaging guidelines
- vendoring is used, but the reasoning is sufficiently explained
- golang: static builds are used, the team confirmed their commitment
to the additional responsibilities implied by static builds.
- not a rust package, no extra constraints to consider in that regard
- Includes vendored code, the package has documented how to refresh this
code at: https:/
Problems:
- embedded source present
- static linking
- does have Built-Using entries
[Security]
OK:
- history of CVEs does not look concerning (but it's a very recent package)
- does not use webkit1,2
- does not use lib*v8 directly
- does not process arbitrary web content
- does not integrate arbitrary javascript...