Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #61276 > unrolled thread

Re: Arch qualification for buster: call for DSA, Security, toolchain concerns

Back to article view | Back to linux.debian.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Arch qualification for buster: call for DSA, Security, toolchain  concerns Moritz Mühlenhoff <jmm@inutil.org> - 2018-06-29 22:40 +0200
    Re: Arch qualification for buster: call for DSA, Security,  toolchain concerns Ben Hutchings <ben@decadent.org.uk> - 2018-06-29 23:40 +0200
      Re: Arch qualification for buster: call for DSA, Security,  toolchain concerns Ben Hutchings <ben@decadent.org.uk> - 2018-06-30 00:10 +0200
      Re: Arch qualification for buster: call for DSA, Security, toolchain  concerns Moritz Mühlenhoff <jmm@inutil.org> - 2018-06-30 22:20 +0200

#61276 — Re: Arch qualification for buster: call for DSA, Security, toolchain concerns

Niels Thykier wrote:
> If the issues and concerns from you or your team are not up to date,
> then please follow up to this email (keeping debian-release@l.d.o and
> debian-ports@l.d.o in CC to ensure both parties are notified).

Two issues that we discussed at the recent Security Team sprint wrt
problems affecting buster:

(1) Linux upstream security support for i386 seems at risk at this point.
E.g. KPTI for i386 still isn't merged in Linux master half a year later after
the public Meltdown disclosure in early January (and the development of KPTI
started months before that). Someone at SuSE actually developed patches
as an older SLES release using Linux 3.0 (!) still supports i386, but that
will also EOL at some point and if we don't have the manpower to
develop upstream fixes for future i386-specific flaws.

It's not a strict blocker, but we wanted to raise the discussion whether
it still makes sense to ship 32 bit kernels for buster, which means with
support until ~ 2022.

(2) Not an architectual issue, but a cross-arch problem: Buster is
reaching a critical mass of applications written in Go and our tooling
for security updates is absolutely not in a position to deal with it's
approach to link everything statically:

dak on ftpmaster and security-master don't share tarballs, IOW the
first time an application is updated in foo-security it's needs an
upload including the orig tarball. That's somewhat manageable for
standard security updates, but if we'd need to recompile all reverse
deps with individual source uploads (which would be dozens to hundreds
of packages if it's e.g. in Golang itself), it ends up being total
madness.

To be able to support Go-based applications in buster-security we
need tooling which
- detects which packages need a rebuild if a given Go package has been
  fixed.
- handles the actual rebuilds and sharing tarballs between security-master
  and ftp-master is an automated manner

Cheers,
        Moritz

[toc] | [next] | [standalone]

#61278 — Re: Arch qualification for buster: call for DSA, Security, toolchain concerns

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2018-06-29 at 22:31 +0200, Moritz Mühlenhoff wrote:
> Niels Thykier wrote:
> > If the issues and concerns from you or your team are not up to date,
> > then please follow up to this email (keeping debian-release@l.d.o and
> > debian-ports@l.d.o in CC to ensure both parties are notified).
> 
> Two issues that we discussed at the recent Security Team sprint wrt
> problems affecting buster:
> 
> (1) Linux upstream security support for i386 seems at risk at this point.
> E.g. KPTI for i386 still isn't merged in Linux master half a year later after
> the public Meltdown disclosure in early January (and the development of KPTI
> started months before that). Someone at SuSE actually developed patches
> as an older SLES release using Linux 3.0 (!) still supports i386, but that
> will also EOL at some point and if we don't have the manpower to
> develop upstream fixes for future i386-specific flaws.
> 
> It's not a strict blocker, but we wanted to raise the discussion whether
> it still makes sense to ship 32 bit kernels for buster, which means with
> support until ~ 2022.
[...]

The lack of Meltdown mitigation on i386 is concerning, though I remain
somewhat hopeful that it will get fixes eventually.  A quick look
through kernel-sec finds maybe 3 other i386-specific issues in the last
5 years (CVE-2013-0190, CVE-2014-4508, CVE-2016-3672), and none of the
fixes were difficult to backport.

It's worth noting that Meltdown also never got mitigated for any of the
other affected architectures (at least ppc64el and s390x) in jessie,
despite being addressed upstream.  So I don't think it makes sense to
pick on i386 as being particularly vulnerable.

Also, I don't think it is currently tenable to have a release
architecture without a kernel.  We still don't have a way to
interactively install multiarch amd64/i386 systems.

Ben.

-- 
Ben Hutchings
Sturgeon's Law: Ninety percent of everything is crap.

[toc] | [prev] | [next] | [standalone]

#61280 — Re: Arch qualification for buster: call for DSA, Security, toolchain concerns

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2018-06-29 at 22:33 +0100, Ben Hutchings wrote:
> On Fri, 2018-06-29 at 22:31 +0200, Moritz Mühlenhoff wrote:
> > Niels Thykier wrote:
> > > If the issues and concerns from you or your team are not up to date,
> > > then please follow up to this email (keeping debian-release@l.d.o and
> > > debian-ports@l.d.o in CC to ensure both parties are notified).
> > 
> > Two issues that we discussed at the recent Security Team sprint wrt
> > problems affecting buster:
> > 
> > (1) Linux upstream security support for i386 seems at risk at this point.
> > E.g. KPTI for i386 still isn't merged in Linux master half a year later after
> > the public Meltdown disclosure in early January (and the development of KPTI
> > started months before that). Someone at SuSE actually developed patches
> > as an older SLES release using Linux 3.0 (!) still supports i386, but that
> > will also EOL at some point and if we don't have the manpower to
> > develop upstream fixes for future i386-specific flaws.
> > 
> > It's not a strict blocker, but we wanted to raise the discussion whether
> > it still makes sense to ship 32 bit kernels for buster, which means with
> > support until ~ 2022.
[...]

Also, if there is a question about the continued use of 32-bit x86
systems, it appears that the AMD Geode LX and VIA C7 processors are
still commercially available.

(I'm ignoring the Intel Quark since it can't run a standard i386 user-
space.)

Ben.

-- 
Ben Hutchings
Sturgeon's Law: Ninety percent of everything is crap.

[toc] | [prev] | [next] | [standalone]

#61285

On Fri, Jun 29, 2018 at 10:33:16PM +0100, Ben Hutchings wrote:
> On Fri, 2018-06-29 at 22:31 +0200, Moritz Mühlenhoff wrote:
> > Niels Thykier wrote:
> > > If the issues and concerns from you or your team are not up to date,
> > > then please follow up to this email (keeping debian-release@l.d.o and
> > > debian-ports@l.d.o in CC to ensure both parties are notified).
> > 
> > Two issues that we discussed at the recent Security Team sprint wrt
> > problems affecting buster:
> > 
> > (1) Linux upstream security support for i386 seems at risk at this point.
> > E.g. KPTI for i386 still isn't merged in Linux master half a year later after
> > the public Meltdown disclosure in early January (and the development of KPTI
> > started months before that). Someone at SuSE actually developed patches
> > as an older SLES release using Linux 3.0 (!) still supports i386, but that
> > will also EOL at some point and if we don't have the manpower to
> > develop upstream fixes for future i386-specific flaws.
> > 
> > It's not a strict blocker, but we wanted to raise the discussion whether
> > it still makes sense to ship 32 bit kernels for buster, which means with
> > support until ~ 2022.
> [...]
> 
> The lack of Meltdown mitigation on i386 is concerning, though I remain
> somewhat hopeful that it will get fixes eventually.  A quick look
> through kernel-sec finds maybe 3 other i386-specific issues in the last
> 5 years (CVE-2013-0190, CVE-2014-4508, CVE-2016-3672), and none of the
> fixes were difficult to backport.

Fair enough. Ultimately it's your call, but we wanted to raise it due to
the long term perspective upstream.

> It's worth noting that Meltdown also never got mitigated for any of the
> other affected architectures (at least ppc64el and s390x) in jessie,
> despite being addressed upstream.  So I don't think it makes sense to
> pick on i386 as being particularly vulnerable.

Well, the difference is that 99% of users still installing a buster system
with i386 are doing it out of ignorance and would otherwise be protected
if they'd picked amd64. For ppc64el and s390x no such alternative exists.

Cheers,
        Moritz

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web