2022-01-01 16:45:52 <danieli> ikke: we use it at work, it's one of the better choices if you need a good API and integration with e.g. gitlab
2022-01-01 16:49:09 <ikke> Yes, we use it as well
2022-01-01 18:56:04 <omni> !29060 !29061
2022-01-01 18:56:23 <omni> how do I know what need to be rebuilt?
2022-01-01 18:56:57 <omni> play it safe and rebuild everything with makedepends go?
2022-01-01 18:56:57 <ikke> Not easily
2022-01-01 18:56:59 <ikke> Yes
2022-01-01 21:08:24 <Ariadne> ikke: i don't have any experience with vault, but i've been told it is alright
2022-01-01 21:19:13 <ikke> ok
2022-01-01 21:19:30 <ikke> My idea was to have a dedicated vps using the file storage backend
2022-01-01 21:53:39 <danieli> that should be fine as long it's somewhat isolated network wise and has as little attack surface as possible
2022-01-01 21:53:40 <danieli> the docs are good
2022-01-02 09:15:07 <ikke> https://gitlab.alpinelinux.org/alpine/aports/-/issues/13368
2022-01-02 09:15:21 <ikke> Should we file a CVE for this? (service running as root instead of user)
2022-01-02 10:25:19 <Ariadne> no, its in testing only
2022-01-02 10:26:08 <ikke> no, it's in community
2022-01-02 10:26:19 <ikke> The one in testing is a custom verison
2022-01-02 10:26:21 <ikke> version*
2022-01-02 21:05:58 <schestowitz> hi, sorry to be off-topic. I am urgently trying to get hold of Ariadne (3+ hours of downtime) and do not have a phone number or anything. Can anyone ping her somehow? I tried IRC and email a few hours ago.
2022-01-03 01:10:34 <Ariadne> ikke: in that case, yes, let’s file for a CVE
2022-01-03 11:40:20 <ikke> Ok, submitted one
2022-01-03 14:38:01 <omni> I don't think I can give !29060 and !29061 much more time right now
2022-01-03 14:38:18 <omni> I got there just trying to upgrade vault ing !29059
2022-01-04 17:58:26 <minimal> FYI: https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.17-Devtmpfs-Change
2022-01-04 17:58:53 <minimal> Looking at /etc/init.d/devfs I see it mounts devtmpfs with nosuid but not with noexec
2022-01-04 19:29:08 <omni> where do I find "Bug #92921" then?
2022-01-04 19:30:41 <omni> ah https://bugs.gentoo.org/92921
2022-01-04 19:31:33 <minimal> you just beat me to it :-)
2022-01-04 19:32:17 <minimal> 2005-era issue
2022-01-04 19:34:13 <omni> yeah.. so make it noexec and see who notices? =)
2022-01-04 19:34:24 <omni> I'll add an fstab entry and see if I run into anything
2022-01-04 19:50:19 <omni> no issues so far, but this is an X free system (with sway/wayland)
2022-01-06 05:35:15 <ikke> CVE-2022-22704 has been assigned for the zabbix-agent2 package
2022-01-07 06:00:01 <ikke> Ariadne: how comes 3.14 and edge are marked as 'fixed', but not 3.15? (there are no secfixes in the APKBUILD) https://security.alpinelinux.org/vuln/CVE-2018-1000874
2022-01-07 12:02:03 <Ariadne> not sure.
2022-01-08 08:27:48 <ikke> https://github.com/tern-tools/tern
2022-01-08 08:28:24 <ikke> SBoM collection tools for containers
2022-01-15 15:27:22 <ikke> https://security.alpinelinux.org/vuln/CVE-2022-22704 euhm, CPE is fore alpinelinux in general, lol
2022-01-15 16:26:49 <Ariadne> well
2022-01-15 16:26:56 <Ariadne> not much i can do about that :P
2022-01-15 16:27:12 <ikke> Can we ask for a correction?
2022-01-15 16:31:06 <Ariadne> yes
2022-01-15 16:31:38 <Ariadne> https://nvd.nist.gov/info/contact-form
2022-01-15 16:31:51 <Ariadne> CPE should probably be alpinelinux:zabbix2
2022-01-15 16:33:18 <ikke> zabbix-agent2
2022-01-15 16:38:09 <Ariadne> do you want me to do it
2022-01-15 16:38:43 <ikke> If you want. Don't mind it to do it myself though
2022-01-15 16:45:54 <Ariadne> done
2022-01-15 16:46:04 <ikke> thanks
2022-01-15 17:53:14 <Ariadne> great news: rustc on s390x got to stage1
2022-01-15 17:53:20 <Ariadne> which means it will probably get to stage2
2022-01-15 17:53:38 <ikke> 0ncie
2022-01-15 17:53:40 <ikke> nice*
2022-01-15 18:33:27 <Ariadne> narrator: it did not get to stage2 but i think i found a solution
2022-01-15 18:35:37 <ikke> Nice that the narrator comes with the solution
2022-01-18 11:19:36 <ikke> https://gitlab.alpinelinux.org/alpine/aports/-/issues/13448
2022-01-18 11:20:28 <ikke> Aqua CSP flags apk-tools being vulnerable for the zabbix-agent2 CVE
2022-01-18 11:54:27 <Ariadne> :D :D :D :D :D :D :D
2022-01-18 18:56:43 <ikke> LOLO
2022-01-18 18:56:45 <ikke> https://nvd.nist.gov/vuln/detail/CVE-2022-22704
2022-01-18 18:56:52 <ikke> Now zabbix is affected :D :D :D :D :D :D 
2022-01-18 18:57:46 <ikke> cpe:2.3:a:zabbix:zabbiz-agent2:*:*:*:*:*:*:*:*
2022-01-18 18:57:56 <ikke> Including a typo
2022-01-18 19:00:56 <Ariadne> amazing
2022-01-18 19:04:23 <Ariadne> https://usercontent.irccloud-cdn.com/file/Sl1FMuvD/Screen%20Shot%202022-01-18%20at%201.04.18%20PM.png
2022-01-18 19:04:26 <Ariadne> oh this seems reasonable
2022-01-18 19:04:50 <Ariadne> cpe:2.3⭕
2022-01-18 19:04:58 <Ariadne> cpe:2.3⭕alpinelinux
2022-01-18 19:05:00 <Ariadne> is fine
2022-01-18 19:05:04 <Ariadne> wtf irccloud
2022-01-18 19:14:03 <ikke> Oh, running on alpine
2022-01-18 19:14:11 <ikke> But the typo is still there
2022-01-18 19:15:07 <ikke> And it does not include -r1 as fixed
2022-01-18 19:15:22 <ikke> Seems like 5.4.9-r0 is fixed as well, doesn't it?
2022-01-18 19:16:07 <Ariadne> yes, that would match 5.4.9-r0
2022-01-18 19:16:07 <Ariadne> lol
2022-01-18 19:16:15 <Ariadne> whatever :D
2022-01-18 20:19:19 <ikke> now they deleted them all
2022-01-18 20:19:46 <ikke> oh, no, just a loading erro
2022-01-18 20:19:48 <ikke> error
2022-01-25 17:52:41 <omni> the latest upstream kernel releases take care of CVE-2022-0185, right?
2022-01-25 17:56:13 <omni> so 3.12-stable should be bumped to 5.4.173, 3.13-stable and 3.14-stable to 5.10.93 and 3.15-stable to 5.15.16 (as edge is at)
2022-01-25 17:58:47 <ikke> omni: could you create an issue for it?
2022-01-25 17:59:00 <omni> sure
2022-01-25 18:04:44 <omni> #13475
2022-01-25 18:10:37 <ikke> omni: thanks
2022-01-26 07:18:30 <ikke> I'm wondering. Is anything using pkexec in alpine? Could we split it into a aubpackage ore completely remove it? 
2022-01-26 11:28:05 <Ariadne> :D
2022-01-26 11:28:16 <Ariadne> ikke: i think lots of things use pkexec
2022-01-26 11:28:21 <Ariadne> on desktop
2022-01-26 11:28:35 <Ariadne> worst case we could try splitting it in edge
2022-01-26 11:28:38 <Ariadne> and see what happens
2022-01-26 11:59:13 <ikke> do we consider the polkit issue sever enough to backport it even further?
2022-01-26 11:59:17 <ikke> severe*
2022-01-26 12:02:17 <Ariadne> no
2022-01-26 12:02:28 <Ariadne> if you have polkit on your system, you already elected to install a rootkit
2022-01-26 12:02:50 <ikke> :)
2022-01-26 12:03:02 <Ariadne> one scoped to the entirety of freedesktop dot org
2022-01-26 12:03:07 <ikke> Apparently there is quite a lot that pulls it in though
2022-01-26 12:03:19 <ikke> https://tpaste.us/bVBZ
2022-01-26 12:03:32 <ikke> (either directly or indirectly)
2022-01-26 12:05:28 <Ariadne> the canonical security team is useless as usual
2022-01-26 15:56:49 <omni> ikke: not sure that list is accurate, I've got fwupd installed but not lolkit-common
2022-01-26 15:59:47 <omni> I have polkit-libs though, required by fwupd
2022-01-26 17:43:55 <Ariadne> yes
2022-01-26 17:44:00 <Ariadne> lets rename polkit to lolkit
2022-01-26 17:44:04 <Ariadne> i love it
2022-01-26 17:44:07 <ikke> +1
2022-01-26 18:07:42 <Ariadne> ncopa, ikke: pwnkit kernel mitigation (because there are assuredly other vulnerable SUID programs, and I want to fix this *once* and be done with it) dropping soon
2022-01-26 18:08:11 <Ariadne> this is honestly the fastest i've ever iterated on something with LKML :)
2022-01-26 18:12:46 <ikke> Heh, Toasty Eggshell
2022-01-26 18:16:02 <Ariadne> we're looking into {NULL, NULL} injection atm
2022-01-26 18:18:58 <Ariadne> i think claiming argc==1 with {"", NULL} is safer
2022-01-26 18:23:25 <ikke> Would make sense to me
2022-01-26 18:23:47 <ikke> then using argv[0] is safe
2022-01-26 18:24:04 <ikke> using it blindly*
2022-01-26 18:33:12 <Ariadne> well, it is safe if it is NULL too in most cases
2022-01-26 18:33:21 <Ariadne> because printf translates NULL to (null)
2022-01-26 18:35:14 <ikke> but something like strlen would fail I believe
2022-01-26 18:35:23 <ikke> Not sure if it makes sense to do that
2022-01-26 18:36:38 <ikke> or strcmp
2022-01-26 18:40:39 <Ariadne> consensus seems to be heading in the direction of {"", NULL}
2022-01-26 20:26:40 <ericonr> Ariadne: it's unfortunatelt still UB and compilers can re-arrange printf() calls to puts() ones which will segfault :/ I really hate that
2022-01-26 20:27:08 <ericonr> 
ACTION has been hit by this "bug"

2022-01-26 20:53:09 <Ariadne> doas bumped to 6.8.2, drew pinged me about it but i didn't get to it until now
2022-01-27 05:35:10 <ikke> nice, kees cook acked your v3
2022-01-27 15:33:28 <Ariadne> yeah, which means spender is probably going to mail a pipebomb to my house
2022-01-27 15:35:12 <jvoisin> come to .eu ♥
2022-01-27 15:45:55 <Foxboron> Ariadne: he'll write a tweet how grsecurity has had a similar patch for the past 2 years
2022-01-27 16:12:51 <ncopa> I think i saw the hunk from grsecurity fixing this on twitter yesterday. I cannot find it now
2022-01-27 16:13:45 <Ariadne> ncopa: its because of TPE
2022-01-27 16:13:48 <ncopa> https://twitter.com/grsecurity/status/1486372249649426437
2022-01-27 16:13:56 <Ariadne> i might revive my tpe-lkm project and upstream it as an LSM
2022-01-27 16:14:25 <Ariadne> i stopped working on it because $twojobsago got a site license to use grsecurity on all of their customers' servers
2022-01-27 16:14:54 <ncopa> the grsecurity fix only solved it for suid binaries IIRC
2022-01-27 16:15:05 <Ariadne> yes, its part of TPE
2022-01-27 16:15:12 <Ariadne> i'm very familiar with the feature
2022-01-27 16:15:21 <Ariadne> i'm just also familiar with the fact that spender is unhinged
2022-01-27 16:15:30 <ncopa> :)
2022-01-27 16:15:32 <Ariadne> and so i prefer to not interact with him
2022-01-27 16:15:37 <ncopa> fair enough
2022-01-27 16:15:54 <psykose> big spender
2022-01-27 16:15:59 <Ariadne> but i am thinking about resurrecting tpe-lkm
2022-01-27 16:16:09 <Ariadne> except actually upstreaming it via KSPP
2022-01-27 16:17:13 <Ariadne> i want grsecurity features back, just, without spender
2022-01-27 16:17:26 <ikke> What is tpe-lkm?
2022-01-27 16:17:35 <Ariadne> trusted path execution linux kernel module
2022-01-27 16:17:45 <Ariadne> the way it worked was by hooking the kernel
2022-01-27 16:17:57 <jvoisin> Ariadne: it's not mitigated in grsec via TPE
2022-01-27 16:18:00 <Ariadne> to prohibit untrusted paths from executing :P
2022-01-27 16:18:09 <Ariadne> jvoisin: yes/no, it uses a lot of the TPE code to do it
2022-01-27 16:18:47 <Ariadne> it's its own option, but it uses the TPE infrastructure to do it
2022-01-27 16:18:50 <jvoisin> TPE was really nice indeed.
2022-01-28 12:54:23 <ncopa> how to report that this is different software than we ship? https://security.alpinelinux.org/vuln/CVE-2015-2987
2022-01-28 12:54:37 <ncopa> 'ed' is not same 'ed' as we ship
2022-01-28 12:55:52 <donoban> ncopa: I think that pushing to here https://gitlab.alpinelinux.org/ariadne/security-rejections
2022-01-28 12:58:00 <donoban> hm, In fact it's already there
2022-01-28 12:58:03 <donoban> ed:
2022-01-28 12:58:04 <donoban>   # Not related to GNU ed.
2022-01-28 12:58:06 <donoban>   - CVE-2015-2987
2022-01-28 15:12:59 <Ariadne> hmm weird i’ll look into why that is reporting unfixed on 3.15 branch
2022-01-29 20:07:06 <ikke> Ariadne: opinion on https://gitlab.alpinelinux.org/alpine/infra/infra/-/issues/1846?
2022-01-29 20:07:42 <Ariadne> i mean, we have basically done that (other than the emailing part)
2022-01-29 20:07:50 <Ariadne> the emailing part is on my eventual to-do
2022-01-29 20:07:51 <ikke> Can probably mention we have @team/security now, and that security issues can be reported as confidential issues
2022-01-29 20:07:54 <ikke> ok
2022-01-29 20:07:55 <Ariadne> yes
2022-01-29 20:08:39 <ikke> It's trivial to create security@lists.alpinelinux.org, with public archive / subscribing disabled
2022-01-30 17:15:47 <Ariadne> ah, spender has gone back to blocking me
2022-01-30 17:15:56 <Ariadne> a christmas miracle
2022-01-30 17:16:00 <Ariadne> in... January!
2022-01-30 17:16:32 <jvoisin> it's ok
2022-01-30 17:21:15 <Ariadne> he's just mad that i worked with kees on something
2022-01-30 17:22:11 <jvoisin> well, if you want to upstream security-related things, kees is usually the right person to talk to
2022-01-30 17:22:31 <Foxboron> Ariadne: I hope you didn't interpret my tweet as being aimed towards you :p
2022-01-30 17:22:40 <Foxboron> (Also congratz on your new job)
2022-01-30 17:23:57 <Ariadne> you mean my job educating docker people how to do this stuff correctly? :p
2022-01-30 17:24:23 <Ariadne> for my next achievement, "apk3 solves world hunger"
2022-01-30 17:24:34 <Foxboron> I don't think the container aspect of sigstore is the most exciting part, really :p
2022-01-30 17:24:46 <Ariadne> oh, i'm not working on sigstore
2022-01-30 17:25:20 <Ariadne> i'm working on "distroless done right"
2022-01-30 17:25:31 <Foxboron> UuuUUUuu
2022-01-30 17:25:40 <Foxboron> That sounds great, frankly
2022-01-30 17:25:55 <Ariadne> powered by apk3
2022-01-30 17:26:32 <Foxboron> Glad to see chainguard investing in things like that :)
2022-01-30 17:26:50 <Ariadne> they want to provide the full ecosystem, use the parts you want
2022-01-30 17:29:31 <Ariadne> Foxboron: though, i think sigstore is cool
2022-01-30 17:29:58 <Ariadne> artifact signing that "just works" is useful
2022-01-30 17:32:48 <Foxboron> Ariadne: And having a common transparency log for build artefacts so you don't need your own tlog setup :)
2022-01-30 17:33:00 <Foxboron> (it's all partially based on my master thesis :p)
2022-01-30 17:33:19 <Foxboron> (the tlog stuff that is)
2022-01-30 17:39:16 <Ariadne> i see, well, i am not a cryptographer :P
2022-01-30 17:40:33 <Foxboron> Neither am I, actually :D But that is a testament to how easy and usefull Transparency Logs are :)
2022-01-31 20:12:25 <ikke> Wondering why https://security.alpinelinux.org/vuln/CVE-2022-22816 does not list older releases
2022-01-31 20:12:39 <ikke> It only shows the versions where we fixed things
2022-01-31 20:12:48 <ikke> but not the releases that were vulnderable
2022-01-31 20:12:52 <ikke> vulnerable
2022-01-31 20:14:33 <ikke> https://tpaste.us/WEjZ