[Bug 2052813] Re: [MIR] bpfcc

2024-02-26 Thread Steve Langasek
llvm-toolchain-17 is in main and there's nothing special about its
libraries for MIR.  This is an ordinary binary promotion.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-02-26 Thread Mark Esler
** Tags added: sec-3897

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-02-26 Thread Christian Ehrhardt 
> llvm-toolchain-17 is in main and there's nothing special about its
libraries for MIR. This is an ordinary binary promotion.

Perfectly fine with me, thanks for confirming.
One less detail to think about.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-04-02 Thread Lukas Märdian
Security review OK (comment #15). I subscribed ~foundations-bugs.

Issue #1 confirmed in comment #4 (and now upgraded to LLVM-18 by doko)
Issue #5 probably not possible due to kernel dependency
Issue #6 autopkgtests sponsored: 
https://launchpad.net/ubuntu/+source/bpfcc/0.29.1+ds-1ubuntu6

Issue #7 still open, consider using something like c++filt,
https://wiki.debian.org/UsingSymbolsFiles#C.2B-.2B-_libraries

** Changed in: bpfcc (Ubuntu)
   Status: In Progress => Incomplete

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-04-02 Thread Christian Ehrhardt 
I'll not mark it "in progress" yet waiting for the "which -tools" to use.
But it would be ready once you settled.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-04-02 Thread Christian Ehrhardt 
Thank you for adding all the QA and clarifying more.

When you change dependencies to pull this in (I see Ubuntu-meta already
did change).

This is trying to get the value to the users, but not clutter where possible.
I think we should depend on libbpf-tools instead of the current bpfcc-tools.

WDYT? Could we do that change before doing promotions?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-04-03 Thread Robie Basak
The main user story being implemented here is the one specified by
Brendan Gregg in his literature, including his book "Systems
Performance, 2nd Edition". In that book he specifies "Linux crisis tool
packages" [Table 4.1], which specifies bpfcc-tools and a bunch of
binaries provided by that.

Looking at the difference between libbpf-tools and bpfcc-tools, the
former is only a subset and doesn't include all the tools specified in
the book. For example, the book covers trace and argdist in section
15.1.6. These have -bpfcc versions provided by bpfcc-tools, but I don't
see any equivalents in libbpf-tools.

The intention is that we install by default what the book covers.
Therefore, I'd like to request (at least initially) that we have bpfcc-
tools in main. If that's not possible then libbpf-tools will be better
than nothing, but will add to the caveats in this entire effort.

Please could you consider the MIR request to be for the bpfcc-tools
binary package?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-04-03 Thread Robie Basak
> [Rationale]
> - The package bpfcc is required in Ubuntu main as a runtime dependency of
>   bpftrace.

Correction: this is true, but we'd also like bpfcc-tools in its own
right since these tools are recommended by experts for direct use.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-04-04 Thread Christian Ehrhardt 
Clarified, moving -release and -proposed as -updates will be deleted
anyway

Also libbpfcc-dev is an auto-include and has no weird dependencies that
make us need to exclude it.

Override component to main
bpfcc 0.29.1+ds-1ubuntu4 in noble: universe/misc -> main
Override [y|N]? y
1 publication overridden.

Override component to main
bpfcc 0.29.1+ds-1ubuntu6 in noble: universe/misc -> main
Override [y|N]? y
1 publication overridden.

Override component to main
libbpfcc 0.29.1+ds-1ubuntu4 in noble arm64: universe/misc/optional/100% -> main
libbpfcc 0.29.1+ds-1ubuntu4 in noble armhf: universe/misc/optional/100% -> main
libbpfcc 0.29.1+ds-1ubuntu4 in noble ppc64el: universe/misc/optional/100% -> 
main
libbpfcc 0.29.1+ds-1ubuntu4 in noble riscv64: universe/misc/optional/100% -> 
main
libbpfcc 0.29.1+ds-1ubuntu4 in noble s390x: universe/misc/optional/100% -> main
python3-bpfcc 0.29.1+ds-1ubuntu4 in noble amd64: universe/python/optional/100% 
-> main
python3-bpfcc 0.29.1+ds-1ubuntu4 in noble arm64: universe/python/optional/100% 
-> main
python3-bpfcc 0.29.1+ds-1ubuntu4 in noble armhf: universe/python/optional/100% 
-> main
python3-bpfcc 0.29.1+ds-1ubuntu4 in noble i386: universe/python/optional/100% 
-> main
python3-bpfcc 0.29.1+ds-1ubuntu4 in noble ppc64el: 
universe/python/optional/100% -> main
python3-bpfcc 0.29.1+ds-1ubuntu4 in noble riscv64: 
universe/python/optional/100% -> main
python3-bpfcc 0.29.1+ds-1ubuntu4 in noble s390x: universe/python/optional/100% 
-> main
bpfcc-tools 0.29.1+ds-1ubuntu4 in noble amd64: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu4 in noble arm64: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu4 in noble armhf: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu4 in noble i386: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu4 in noble ppc64el: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu4 in noble riscv64: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu4 in noble s390x: universe/misc/optional/100% -> 
main
libbpfcc-dev 0.29.1+ds-1ubuntu4 in noble arm64: universe/libdevel/optional/100% 
-> main
libbpfcc-dev 0.29.1+ds-1ubuntu4 in noble armhf: universe/libdevel/optional/100% 
-> main
libbpfcc-dev 0.29.1+ds-1ubuntu4 in noble ppc64el: 
universe/libdevel/optional/100% -> main
libbpfcc-dev 0.29.1+ds-1ubuntu4 in noble riscv64: 
universe/libdevel/optional/100% -> main
libbpfcc-dev 0.29.1+ds-1ubuntu4 in noble s390x: universe/libdevel/optional/100% 
-> main
Override [y|N]? y
24 publications overridden.

Override component to main
libbpfcc 0.29.1+ds-1ubuntu6 in noble amd64: universe/misc/optional/100% -> main
libbpfcc 0.29.1+ds-1ubuntu6 in noble arm64: universe/misc/optional/100% -> main
libbpfcc 0.29.1+ds-1ubuntu6 in noble armhf: universe/misc/optional/100% -> main
libbpfcc 0.29.1+ds-1ubuntu6 in noble ppc64el: universe/misc/optional/100% -> 
main
libbpfcc 0.29.1+ds-1ubuntu6 in noble riscv64: universe/misc/optional/100% -> 
main
libbpfcc 0.29.1+ds-1ubuntu6 in noble s390x: universe/misc/optional/100% -> main
python3-bpfcc 0.29.1+ds-1ubuntu6 in noble amd64: universe/python/optional/100% 
-> main
python3-bpfcc 0.29.1+ds-1ubuntu6 in noble arm64: universe/python/optional/100% 
-> main
python3-bpfcc 0.29.1+ds-1ubuntu6 in noble armhf: universe/python/optional/100% 
-> main
python3-bpfcc 0.29.1+ds-1ubuntu6 in noble i386: universe/python/optional/100% 
-> main
python3-bpfcc 0.29.1+ds-1ubuntu6 in noble ppc64el: 
universe/python/optional/100% -> main
python3-bpfcc 0.29.1+ds-1ubuntu6 in noble riscv64: 
universe/python/optional/100% -> main
python3-bpfcc 0.29.1+ds-1ubuntu6 in noble s390x: universe/python/optional/100% 
-> main
bpfcc-tools 0.29.1+ds-1ubuntu6 in noble amd64: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu6 in noble arm64: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu6 in noble armhf: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu6 in noble i386: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu6 in noble ppc64el: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu6 in noble riscv64: universe/misc/optional/100% -> 
main
bpfcc-tools 0.29.1+ds-1ubuntu6 in noble s390x: universe/misc/optional/100% -> 
main
libbpfcc-dev 0.29.1+ds-1ubuntu6 in noble amd64: universe/libdevel/optional/100% 
-> main
libbpfcc-dev 0.29.1+ds-1ubuntu6 in noble arm64: universe/libdevel/optional/100% 
-> main
libbpfcc-dev 0.29.1+ds-1ubuntu6 in noble armhf: universe/libdevel/optional/100% 
-> main
libbpfcc-dev 0.29.1+ds-1ubuntu6 in noble ppc64el: 
universe/libdevel/optional/100% -> main
libbpfcc-dev 0.29.1+ds-1ubuntu6 in noble riscv64: 
universe/libdevel/optional/100% -> main
libbpfcc-dev 0.29.1+ds-1ubuntu6 in noble s390x: universe/libdevel/optional/100% 
-> main
Override [y|N]? y
26 publications overridden.

Yes different numbers, some builds where missing of 0.29.1+ds-1ubuntu4

** Changed in: bpfcc (Ubuntu)
   Status:

[Bug 2052813] Re: [MIR] bpfcc

2024-04-04 Thread Christian Ehrhardt 
Dependency is shown in mismatches, setting to Fix Committed.

I thought in the current situation we'd need to promote all (-release,
-updates, -proposed), but on bpftrace only -release was moved. Let me
check on that before that might interfere with the current archive
activities.

If anyone else comes by knowing for sure, this can be promoted
(src:bpfcc bin:libbpfcc bin:python3-bpfcc bin:bpfcc-tools).

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-04-06 Thread Christian Ehrhardt 
Thank you for the check and explanation.

While that is sad for size (80m vs 20m) it makes sense for the purpose.
And this isn't in minimal so it seems sort of ok to me.

Trying to unblock things this seems ready now.

** Changed in: bpfcc (Ubuntu)
   Status: Incomplete => In Progress

** Changed in: bpfcc (Ubuntu)
   Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-02-27 Thread Mate Kukri
#2 i had a look through the bug tracker, but some of the bugs are rather
difficult to triage given that they reference years old Ubuntu releases

#5 some probably could, but I don't have the understanding needed of the
BPF ecosystem to pull this off

#6 see attached patch for this, unfortunately some of these tests do
still fail currently

#7 unfortunately this seems rather difficult to do as libbpfcc seem to
export a large number of c++ symbols


** Patch added: "1-0.29.1+ds-1ubuntu3.diff"
   
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+attachment/5749756/+files/1-0.29.1+ds-1ubuntu3.diff

** Changed in: bpfcc (Ubuntu)
   Status: Incomplete => Opinion

** Changed in: bpfcc (Ubuntu)
   Status: Opinion => In Progress

** Changed in: bpfcc (Ubuntu)
 Assignee: Mate Kukri (mkukri) => (unassigned)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-02-27 Thread Seth Arnold
> Specific binary packages built, but NOT to be promoted to main: python3-bpfcc,
> bpfcc-tools, [...]

I would have thought that getting these tools would have been the entire
point of this MIR. There's an immense amount of value built in them, and
without the tools we've got the framework but no pre-built way to
consume it. These pre-built tools are 99% of why I want this package
promoted.

(A similar question was raised for the bpftrace package -- we might as
well just stop reviewing these packages if we remove the actual tools
from the packages.)

What's the rationale for not promoting the tools?

Thanks

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-02-27 Thread Mate Kukri
I believe we do want to promote bpfcc-tools as well, at least that
binary name was mentioned before, but this package is also needed as a
dependency for bpftrace too.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-02-27 Thread Mark Esler
Promoting bpfcc-tools and bpftrace is driving promotion of bpfcc based
on FO147.

Also, bpftrace's /usr/sbin/*.bt files re-implement bpfcc-tools with
bpftrace.

Assigning to Security for MIR, with root-use scope kept in mind. Only
code for libbpfcc and bpfcc-tools will be reviewed.

** Changed in: bpfcc (Ubuntu)
 Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-02-27 Thread Mark Esler
Máté, could you please see if the rational can be broadened for FO147?

I suspect that libbpf-tools is also important.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-02-28 Thread Mark Esler
Some of the bpf tools do not work on mantic.

e.g. `/usr/sbin/tcptop-bpfcc` from `bpfcc-tools` does not work, but
`/usr/sbin/tcptop` from `libbpfcc` does (on mantic)

Kernel configs and pahole version used to build mantic's kernel should
be okay https://github.com/iovisor/bcc/tree/master/libbpf-tools ?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-03-07 Thread Mate Kukri
This should bring some working autopkgtests to this package by disabling
a set of failing tests.

** Patch added: "1-0.29.1+ds-1ubuntu4.diff"
   
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+attachment/5753840/+files/1-0.29.1+ds-1ubuntu4.diff

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-03-15 Thread Mate Kukri
Added DEP3 header

** Patch added: "2-0.29.1+ds-1ubuntu4.diff"
   
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+attachment/5756245/+files/2-0.29.1+ds-1ubuntu4.diff

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 2052813] Re: [MIR] bpfcc

2024-03-15 Thread Mark Esler
I reviewed bpfcc 0.29.1+ds-1ubuntu2 as checked into noble.  This shouldn't be
considered a full audit but rather a quick gauge of maintainability.

- CVE History
  - no CVEs tracked in UCT, initially
  - searching for "bcc" CVEs finds false-positives
- Build-Depends
  - nothing concerning
- pre/post inst/rm scripts
  - typical dh_python3 for python3-bpfcc
- init scripts
  - none
- systemd units
  - none
- dbus services
  - none
- setuid binaries
  - none
- binaries in PATH
  - numerous. +220.
- sudo fragments
  - none
- polkit files
  - none
- udev rules
  - none
- unit tests / autopkgtests
  - some added
- cron jobs
  - none
- Build logs
  - hardening-no-pie is not a concern in this case
  - manual page warnings
  - W: libbpfcc: package-name-doesnt-match-sonames libbcc-bpf0 libbcc0

- Processes spawned
  - popen use looks okay
  - system("clear") is fine
  - memleak.c uses fork, etc
- Memory management
  - extremely heavy use
  - in context, I am not concerned with occult practices in this package
- File IO
  - heavy use
- Logging
  - extremely heavy use
- Environment variable usage
  - none
- Use of privileged functions
  - Security's MIR tooling finds many false-positives
  - vmlinux headers are fine
- Use of cryptography / random number sources etc
  - none
  - vminux*.h sets certificate configs
- Use of temp files
  - tmp race conditions possibly allow unauthenticated users to control 
unpacked kernel headers
- Resolved quickly by upstream! CVE-2024-2314
- see related issue in bpftrace MIR (LP#2052809)
- Use of networking
  - heavy use
- Use of WebKit
  - none
- Use of PolicyKit
  - none

- Any significant cppcheck and Covreity results
  - bugs found (memory leaks etc), but not concerned about these being 
vulnerabilities in context
  - parsing untrusted data (e.g., network traffic) could possibly lead to 
exploitation
  - coverity.txt attached
- Any significant shellcheck results
  - not concerning
- Any significant bandit results
  - none
  - subprocess calls cannot be controlled without root access
- Any significant govulncheck results
  - none
- Any significant Semgrep results
  - none
  - complaints about system() and strtok excused in context

There is 986,872 loc. Security's review is limited.

As with bpftrace, these are admin tools which require root access. It is
unlikely that most bugs in bpfcc would cause a loss of security and
become a vulnerability; root already has control. Parsing untrusted data
with a root process can lead to trouble. This review expects that
developers will want to use these tools and that system administrators
will make wise choices.

Some binaries do not work out of box. This needs testings. e.g.,
/usr/sbin/tcptop-bpfcc from bpfcc-tools does not work, but
/usr/sbin/tcptop from libbpfcc does.

Binaries from bpfcc-tools, libbpfcc, and bpftrace have redundant
functions. Please consider which binaries should be made default. In
particular, most bpftrace binaries are merely examples.

The bcc snap is published by Canonical and should be updated. See
./snap/README.md

Upstream was extraordinarily quick at addressing a potential security issue 
which was reported to them \o/
 - CVE-2024-2314

Security team ACK for promoting bpfcc to main. Note that Security's ACK
is for all packages generated by the bpfcc source package, the MIR
Team's ACK may only be for a subset of binary packages.

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-2314

** Changed in: bpfcc (Ubuntu)
 Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Re: [Bug 2052813] Re: [MIR] bpfcc

2024-02-27 Thread Christian Ehrhardt 
On Wed, Feb 28, 2024 at 5:00 AM Mark Esler <2052...@bugs.launchpad.net> wrote:
>
> Máté, could you please see if the rationale can be broadened for FO147?
> I suspect that libbpf-tools is also important.

As far as I can see it is even the same functionality and the same
code, just built differently to work with less dependencies.
So a review of quality and maintainability of the source should cover
both anyway (with the difference being in the build instructions).

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2052813

Title:
  [MIR] bpfcc

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bpfcc/+bug/2052813/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs