-
The last few days I have done some upgrade testing in Debian, to
-see if the upgrade from Lenny to Squeeze will go smoothly. A few bugs
-have been discovered and reported in the process
-(#585410 in nagios3-cgi,
-#584879 already fixed in
-enscript and #584861 in
-kdebase-workspace-data), and to get a more regular testing going on, I
-am working on a script to automate the test.
-
-
The idea is to create a Lenny chroot and use tasksel to install a
-Gnome or KDE desktop installation inside the chroot before upgrading
-it. To ensure no services are started in the chroot, a policy-rc.d
-script is inserted. To make sure tasksel believe it is to install a
-desktop on a laptop, the tasksel tests are replaced in the chroot
-(only acceptable because this is a throw-away chroot).
-
-
A naive upgrade from Lenny to Squeeze using aptitude dist-upgrade
-currently always fail because udev refuses to upgrade with the kernel
-in Lenny, so to avoid that problem the file /etc/udev/kernel-upgrade
-is created. The bug report
-#566000 make me suspect
-this problem do not trigger in a chroot, but I touch the file anyway
-to make sure the upgrade go well. Testing on virtual and real
-hardware have failed me because of udev so far, and creating this file
-do the trick in such settings anyway. This is a
-known
-issue and the current udev behaviour is intended by the udev
-maintainer because he lack the resources to rewrite udev to keep
-working with old kernels or something like that. I really wish the
-udev upstream would keep udev backwards compatible, to avoid such
-upgrade problem, but given that they fail to do so, I guess
-documenting the way out of this mess is the best option we got for
-Debian Squeeze.
-
-
Anyway, back to the task at hand, testing upgrades. This test
-script, which I call upgrade-test for now, is doing the
-trick:
-
-
-#!/bin/sh
-set -ex
-
-if [ "$1" ] ; then
- desktop=$1
-else
- desktop=gnome
-fi
-
-from=lenny
-to=squeeze
-
-exec < /dev/null
-unset LANG
-mirror=http://ftp.skolelinux.org/debian
-tmpdir=chroot-$from-upgrade-$to-$desktop
-fuser -mv .
-debootstrap $from $tmpdir $mirror
-chroot $tmpdir aptitude update
-cat > $tmpdir/usr/sbin/policy-rc.d <<EOF
-#!/bin/sh
-exit 101
-EOF
-chmod a+rx $tmpdir/usr/sbin/policy-rc.d
-exit_cleanup() {
- umount $tmpdir/proc
-}
-mount -t proc proc $tmpdir/proc
-# Make sure proc is unmounted also on failure
-trap exit_cleanup EXIT INT
-
-chroot $tmpdir aptitude -y install debconf-utils
-
-# Make sure tasksel autoselection trigger. It need the test scripts
-# to return the correct answers.
-echo tasksel tasksel/desktop multiselect $desktop | \
- chroot $tmpdir debconf-set-selections
-
-# Include the desktop and laptop task
-for test in desktop laptop ; do
- echo > $tmpdir/usr/lib/tasksel/tests/$test <<EOF
-#!/bin/sh
-exit 2
-EOF
- chmod a+rx $tmpdir/usr/lib/tasksel/tests/$test
-done
-
-DEBIAN_FRONTEND=noninteractive
-DEBIAN_PRIORITY=critical
-export DEBIAN_FRONTEND DEBIAN_PRIORITY
-chroot $tmpdir tasksel --new-install
-
-echo deb $mirror $to main > $tmpdir/etc/apt/sources.list
-chroot $tmpdir aptitude update
-touch $tmpdir/etc/udev/kernel-upgrade
-chroot $tmpdir aptitude -y dist-upgrade
-fuser -mv
-
-
-
I suspect it would be useful to test upgrades with both apt-get and
-with aptitude, but I have not had time to look at how they behave
-differently so far. I hope to get a cron job running to do the test
-regularly and post the result on the web. The Gnome upgrade currently
-work, while the KDE upgrade fail because of the bug in
-kdebase-workspace-data
-
-
I am not quite sure what kind of extract from the huge upgrade logs
-(KDE 167 KiB, Gnome 516 KiB) it make sense to include in this blog
-post, so I will refrain from trying. I can report that for Gnome,
-aptitude report 760 packages upgraded, 448 newly installed, 129 to
-remove and 1 not upgraded and 1024MB need to be downloaded while for
-KDE the same numbers are 702 packages upgraded, 507 newly installed,
-193 to remove and 0 not upgraded and 1117MB need to be downloaded
-
-
I am very happy to notice that the Gnome desktop + laptop upgrade
-is able to migrate to dependency based boot sequencing and parallel
-booting without a hitch. Was unsure if there were still bugs with
-packages failing to clean up their obsolete init.d script during
-upgrades, and no such problem seem to affect the Gnome desktop+laptop
-packages.
+
The last few days I have looked at ways to track open security
+issues here at my work with the University of Oslo. My idea is that
+it should be possible to use the information about security issues
+available on the Internet, and check our locally
+maintained/distributed software against this information. It should
+allow us to verify that no known security issues are forgotten. The
+CVE database listing vulnerabilities seem like a great central point,
+and by using the package lists from Debian mapped to CVEs provided by
+the testing security team, I believed it should be possible to figure
+out which security holes were present in our free software
+collection.
+
+
After reading up on the topic, it became obvious that the first
+building block is to be able to name software packages in a unique and
+consistent way across data sources. I considered several ways to do
+this, for example coming up with my own naming scheme like using URLs
+to project home pages or URLs to the Freshmeat entries, or using some
+existing naming scheme. And it seem like I am not the first one to
+come across this problem, as MITRE already proposed and implemented a
+solution. Enter the Common
+Platform Enumeration dictionary, a vocabulary for referring to
+software, hardware and other platform components. The CPE ids are
+mapped to CVEs in the National
+Vulnerability Database, allowing me to look up know security
+issues for any CPE name. With this in place, all I need to do is to
+locate the CPE id for the software packages we use at the university.
+This is fairly trivial (I google for 'cve cpe $package' and check the
+NVD entry if a CVE for the package exist).
+
+
To give you an example. The GNU gzip source package have the CPE
+name cpe:/a:gnu:gzip. If the old version 1.3.3 was the package to
+check out, one could look up
+cpe:/a:gnu:gzip:1.3.3
+in NVD and get a list of 6 security holes with public CVE entries.
+The most recent one is
+CVE-2010-0001,
+and at the bottom of the NVD page for this vulnerability the complete
+list of affected versions is provided.
+
+
The NVD database of CVEs is also available as a XML dump, allowing
+for offline processing of issues. Using this dump, I've written a
+small script taking a list of CPEs as input and list all CVEs
+affecting the packages represented by these CPEs. One give it CPEs
+with version numbers as specified above and get a list of open
+security issues out.
+
+
Of course for this approach to be useful, the quality of the NVD
+information need to be high. For that to happen, I believe as many as
+possible need to use and contribute to the NVD database. I notice
+RHEL is providing
+a
+map from CVE to CPE, indicating that they are using the CPE
+information. I'm not aware of Debian and Ubuntu doing the same.
+
+
To get an idea about the quality for free software, I spent some
+time making it possible to compare the CVE database from Debian with
+the CVE database in NVD. The result look fairly good, but there are
+some inconsistencies in NVD (same software package having several
+CPEs), and some inaccuracies (NVD not mentioning buggy packages that
+Debian believe are affected by a CVE). Hope to find time to improve
+the quality of NVD, but that require being able to get in touch with
+someone maintaining it. So far my three emails with questions and
+corrections have not seen any reply, but I hope contact can be
+established soon.
+
+
An interesting application for CPEs is cross platform package
+mapping. It would be useful to know which packages in for example
+RHEL, OpenSuSe and Mandriva are missing from Debian and Ubuntu, and
+this would be trivial if all linux distributions provided CPE entries
+for their packages.