X-Original-To: alpine-devel@mail.alpinelinux.org Delivered-To: alpine-devel@mail.alpinelinux.org Received: from mail.alpinelinux.org (dallas-a1.alpinelinux.org [127.0.0.1]) by mail.alpinelinux.org (Postfix) with ESMTP id C6A64DC8482 for ; Thu, 24 Mar 2016 22:21:30 +0000 (UTC) Received: from mail-qg0-f42.google.com (mail-qg0-f42.google.com [209.85.192.42]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mail.alpinelinux.org (Postfix) with ESMTPS id 86C70DC1978 for ; Thu, 24 Mar 2016 22:21:29 +0000 (UTC) Received: by mail-qg0-f42.google.com with SMTP id u110so49943469qge.3 for ; Thu, 24 Mar 2016 15:21:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coreos.com; s=google; h=date:from:to:message-id:in-reply-to:references:subject:mime-version; bh=GwgZ6Lij5ppsf5rVDwjpdc3iLJf63wdLuwVxn+vk+LQ=; b=XW1FU8rQPykpvqHsT1eigZ32xafhlkBb1IjqigpGl31PqCuzLs0mL7hFpEW3hYIfxD mCrcraKWU8mHb5OXw/tjmhJ+qLEE9Ive69HiDY2YLg0unOliLfa0AdKWK4N5DmGM10ja RpAJd0l+TfNH777OBQ+UhOBV0f0RpsxbawZK8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:message-id:in-reply-to:references :subject:mime-version; bh=GwgZ6Lij5ppsf5rVDwjpdc3iLJf63wdLuwVxn+vk+LQ=; b=SMaU4LCp/aXqZCIfkR9z9VGNVT3Iyheg7LxxvE3ZgI19h8fmffL2PC/cE3bczTfm4v 603aZWDvNfi6ZX3j4bZzm3ImTI8mqjK52+NOrxdBjozeA0LTIL6QBI+RfW4TVSqZN3J2 8FbFLT+YmwoBUpdqZ/qLQLNkUrHybf4Z5N9xDXU9FoYxzKlrfv0FQjlpJMAZblKgj9Mm TEYRoIbVuOYxjCGWumDQyXyT9q0GBCL/XQZo5w0akq0EVVsxP0BKQfeaM4RzeOyzXxRn ZoGf+Lux2mtv4crc4lJkxGs5W+vARyyE0H8FlLUB/NYhTWIchITgLibBxqOriBcmWsEx XTsA== X-Gm-Message-State: AD7BkJLIzLTOjCQfH7R/x3P1SmJCNbEuFns99Z/5WcIuYHBLzc53vFpLBnG+FuuS7LxHqJzm X-Received: by 10.140.27.132 with SMTP id 4mr13719446qgx.6.1458858088308; Thu, 24 Mar 2016 15:21:28 -0700 (PDT) Received: from Mentalow-2.local ([65.209.47.35]) by smtp.gmail.com with ESMTPSA id 2sm4131287qgi.33.2016.03.24.15.21.26 for (version=TLSv1/SSLv3 cipher=OTHER); Thu, 24 Mar 2016 15:21:27 -0700 (PDT) Date: Thu, 24 Mar 2016 18:21:25 -0400 From: Quentin Machu To: alpine-devel@lists.alpinelinux.org Message-ID: In-Reply-To: <1458853405.9023.10.camel@c89m3s1> References: <1458852606.9023.4.camel@c89m3s1> <1458853405.9023.10.camel@c89m3s1> Subject: Re: [alpine-devel] Alpine security tracker X-Mailer: Airmail Beta (353) X-Mailinglist: alpine-devel Precedence: list List-Id: Alpine Development List-Unsubscribe: List-Post: List-Help: List-Subscribe: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="56f46865_28489127_644" X-Virus-Scanned: ClamAV using ClamSMTP --56f46865_28489127_644 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Thanks for your open and quick answers. =46rom:=C2=A0Leonardo Arena=C2=A0 We already do that in our bug traker:=C2=A0https://bugs.alpinelinux.org/p= rojects/alpine/issues=3Fset=5Ffilter=3D1&status=5Fid=3Dc&tracker=5Fid=3D1= =C2=A0 That=E2=80=99s great=21 I regret that I wasn=E2=80=99t aware of this yet.= =46rom:=C2=A0Andy Shinn=C2=A0 I wonder if just an additional field or two in Redmine could help=C2=A0 satisfy requirements for Clair without adding too much additional=C2=A0 overhead. What if Redmine had an additional tracker called Security=C2=A0= and a custom CVE field that container the CVE. Would this be too much=C2=A0= additional work for users / maintainers entering data when it is=C2=A0 related to a CVE=3F=C2=A0 Redmine already provides a way to grab data from the tracker in CSV=C2=A0= and XML form. If Clair could filter on a Security tracker to get the=C2=A0= CVE and associated packages then this might be a simple addition to=C2=A0= start work on the Clair side (assuming this is a valid way of=C2=A0 consuming the CVE data).=C2=A0 Definitely, parsing properly seems to be the obstacle here. Extracting da= ta from human-written text is unfortunately impracticable. However, Clair= could undoubtedly parse Alpine=E2=80=99s Redmine if it would expose data= in a fixed format (i.e. static fields available in CSV/XML/YAML/JSON=E2=80= =A6). About a vulnerability, Clair usually ingests: - Vulnerability name, - Severity (e.g. Negligible, Low, Medium, High, Critical), - Short description about the vulnerability, - Link (e.g. link to Redmine), - A list of affected package names, with their fixed version if applicabl= e (otherwise, all versions are considered vulnerable). Typically, the affected packages are also namespaced by the operating sys= tem version. This is useful to keep track of back ports. A specific vulne= rability affecting a package X could be fixed by 1.44+bp2 in an oldstable= distribution but fixed by 1.59 in the stable distribution. In that case,= we would have twice package X in the list, but with two different namesp= aces and versions. I am not familiar with Alpine Linux to know if this ma= kes sense here. If it doesn't (i.e. if we can usually upgrade any package= to the latest versions), then it doesn=E2=80=99t matter, a single namesp= ace can be used. Another small concern, that we encounter with Arch Linux support =5B1=5D,= is reliability: it is quite important to be able to determine which data= can be trusted. We must avoid consuming data filled by malicious users w= ho would like to manipulate 3rd party applications (such as Clair). This = can be mitigated with various solutions though. =46rom:=C2=A0Leonardo Arena=C2=A0 we try do more the actual=C2=A0work, than the paperwork ;-)=C2=A0 I absolutely agree with you on that point.=C2=A0If making Alpine=E2=80=99= s security data a bit more formatted, thus enabling automated systems to = collect data in an useful way, represents=C2=A0a tiny/modest amount of wo= rk, I believe=C2=A0that it would be an important step forward for everybo= dy in terms of security. What do you think=3F =5B1=5D:=C2=A0https://github.com/coreos/clair/pull/60=23issuecomment-1696= 99188 Best Regards, Quentin Machu =46rom:=C2=A0Leonardo Arena Reply:=C2=A0Leonardo Arena Date:=C2=A0March 24, 2016 at 5:03:28 PM To:=C2=A0Quentin Machu CC:=C2=A0alpine-devel=40lists.alpinelinux.org Subject:=C2=A0 Re: =5Balpine-devel=5D Alpine security tracker =20 Il giorno gio, 24/03/2016 alle 21.50 +0100, Leonardo Arena ha scritto: =20 > Il giorno gio, 24/03/2016 alle 16.34 -0400, Quentin Machu ha scritto: =20 > > Hi, =20 > > =20 > =20 > Hi, =20 > =20 > > =20 > > My name=E2=80=99s Quentin Machu and I am the primary maintainer of Cl= air =5B1=5D, =20 > > an open source project for the static analysis of vulnerabilities in = =20 > > containers, by CoreOS. The project, which aim at bringing security =20 > > awareness to everyone, recently went 1.0 =5B2=5D and is considerably = well =20 > > received by the community. =20 > > =20 > > =20 > > As Alpine grows more and more popular, especially for containers to =20 > > which it becomes a really common base image, I believe that it would = =20 > > be extremely valuable for Alpine to track vulnerabilities that may =20 > > affect its packages. =20 > =20 > We already do that in our bug traker: =20 > https://bugs.alpinelinux.org/projects/alpine/issues=3Fset=5Ffilter=3D1&= status=5Fid=3Dc&tracker=5Fid=3D1 =20 > =20 > =20 > > Several Linux distributions, such as Debian =5B3=5D=5B4=5D, Ubuntu =5B= 5=5D=5B6=5D, =20 > > RHEL =5B7=5D=5B8=5D, Arch =5B9=5D, already do through advisories and = parsable =20 > > databases. =20 > > =20 > =20 > We don't issue our own advisories if that's what you mean. That would =20 > require more man power which I think we prefer to spend on fixing the =20 > security issues. =20 > =20 Just as an example, apparently Debian stable and older are still =20 vulnerable to CVE-2016-3115 =5B1=5D. We didn't issue an advisory but Alpi= ne =20 is no longer vulnerable =5B2=5D=5B3=5D, not even its older supported rele= ase =20 =5B4=5D. =20 I'm not saying that's always the case, but we try do more the actual =20 work, than the paperwork ;-) =20 - leo =20 =5B1=5D https://security-tracker.debian.org/tracker/CVE-2016-3115 =20 =5B2=5D https://bugs.alpinelinux.org/issues/5286 =20 =5B3=5D https://bugs.alpinelinux.org/issues/5287 =20 =5B4=5D https://bugs.alpinelinux.org/issues/5288 =20 --56f46865_28489127_644 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline