14:00:27 <Sparks> #startmeeting Security Team Meeting - Agenda: https://fedoraproject.org/wiki/Security_Team_meetings 14:00:27 <zodbot> Meeting started Thu May 5 14:00:27 2016 UTC. The chair is Sparks. Information about MeetBot at http://wiki.debian.org/MeetBot. 14:00:27 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic. 14:00:27 <zodbot> The meeting name has been set to 'security_team_meeting_-_agenda:_https://fedoraproject.org/wiki/security_team_meetings' 14:00:29 <Sparks> #meetingname Fedora Security Team 14:00:29 <zodbot> The meeting name has been set to 'fedora_security_team' 14:00:41 <Sparks> #topic Roll Call 14:00:42 * Sparks 14:00:51 <linuxmodder> .hello linuxmodder 14:00:52 <zodbot> linuxmodder: linuxmodder 'Corey W Sheldon' <sheldon.corey@openmailbox.org> 14:01:10 <skamath> .hello skamath 14:01:11 <zodbot> skamath: skamath 'Sachin S Kamath ' <sskamath96@gmail.com> 14:01:57 <linuxmodder> I may drop out fyi I'm on a sketchy connect 14:02:23 <mhayden> .hello mhayden 14:02:24 <zodbot> mhayden: mhayden 'Major Hayden' <major@mhtx.net> 14:03:16 * d-caf 14:03:32 <d-caf> .hello d-daf 14:03:33 <zodbot> d-caf: Sorry, but you don't exist 14:03:38 <d-caf> LOL 14:03:55 <d-caf> .hello d-caf 14:03:56 <zodbot> d-caf: Sorry, but you don't exist 14:04:01 <linuxmodder> no ghosts or illegals allowed :) 14:04:08 <d-caf> LOL 14:04:17 <d-caf> I'm so broken... 14:04:18 <linuxmodder> damn stowaways :) 14:04:52 <Astradeus> .hello astra 14:04:53 <zodbot> Astradeus: astra 'David Kaufmann' <astra@ionic.at> 14:04:56 * Sparks cleans up the queue for the FST FAS group 14:05:51 <Sparks> Okay, lets get started... 14:06:02 <Sparks> #info Participants are reminded to make liberal use of #info #link #help in order to make the minutes "more better" 14:06:19 <linuxmodder> sidenote: finishing up edits on install-guide for pagure and hitting security-guide today (may have questions for the more seasoned folks later ) 14:06:31 <Sparks> linuxmodder: Awesome 14:06:51 <Sparks> #chair mhayden d-caf Astradeus linuxmodder 14:06:51 <zodbot> Current chairs: Astradeus Sparks d-caf linuxmodder mhayden 14:06:53 <d-caf> linuxmodder: cool! 14:06:59 <linuxmodder> planning to pull out the selinux guide shoehorned stuff and update/ validate selinux-guide as well 14:07:13 <linuxmodder> that later part is likely to be a pita 14:07:25 <d-caf> yeah linuxmodder! yeah SELinux! 14:07:25 <Sparks> linuxmodder: You might just be able to revert the import in git. 14:07:51 <Sparks> #topic Follow up on last week's tasks 14:07:54 * d-caf currently dealing with crond_t domain transitions to customer policies.... 14:08:04 * Sparks notes pjp isn't here. 14:08:18 <Sparks> #action pjp to give a status update on security policy in the wiki (carried over) 14:08:29 <Sparks> #action Sparks to figure out how FST members can get access to Fedora security bugs (carried over) 14:08:29 <linuxmodder> Sparks, will tag up later with you for that then 14:08:43 <linuxmodder> for the 3rd week now :) 14:09:05 <Sparks> d-caf: Have you had a chance to look at the feature requests for private builds? 14:09:12 <d-caf> I have :-) 14:09:31 <linuxmodder> private builds were the embargoed build thing yes? 14:09:41 <Sparks> d-caf: Nice! Okay, I'll set a topic for this meeting to talk about it, then. 14:09:47 <Sparks> linuxmodder: Yes 14:09:48 <d-caf> I spent several hours digging through Koji and Bodhi documentation and open tickets seeing what was/wan't there for our goals 14:10:03 <Sparks> #action zoglesby to update the reading list for the Apprenticeship 14:10:22 <dgilmore> d-caf: nothing is there for your goals :( 14:10:23 <Sparks> #topic Private builds in infrastructure for embargoed bits 14:10:34 <Sparks> d-caf: Tell us what you've found out. 14:10:53 <d-caf> So, koji is actually a little closer to our goals than I thought 14:11:12 <dgilmore> d-caf: how? 14:11:22 <linuxmodder> buildoverrides ? 14:11:30 <dgilmore> d-caf: there is nothing in koji that is close to doing what you want 14:11:32 <dgilmore> or neeed 14:11:34 <dgilmore> need 14:11:37 <d-caf> Still probably needs a few things added, but looking over the policy language it seems that you can specify a lot of specific permissions per user 14:11:54 <dgilmore> d-caf: not really 14:12:27 <dgilmore> d-caf: and any build is visible, you are going to have to write a lot of code to hide a build until an embargo is lifted 14:12:30 <d-caf> So the policy language allows restricting what tags/tasks can be accessed 14:13:01 <dgilmore> d-caf: it does not 14:13:26 <d-caf> dgilmore: fine, I'll stop talking then 14:13:49 <d-caf> dgilmore: you are telling me no before i even finish writing anything 14:14:01 <Sparks> d-caf: Please continue 14:14:07 <dgilmore> d-caf: I will shut up 14:14:36 <Sparks> d-caf: And point to docs so we can clear up any confusion if what you are saying is, in fact, incorrect. 14:15:04 <d-caf> I will be a moment, I have to go find what I was reading over as I'm on a different computer 14:15:22 <d-caf> https://fedoraproject.org/wiki/Koji/Policies 14:16:14 <d-caf> So, in this policy there is the ability to confine things. based on tags 14:16:14 <Sparks> #link https://fedoraproject.org/wiki/Koji/Policies 14:17:20 <d-caf> Though we would need to get the policy expanded to better handle user perms (vs admin vs everyone else) there is potential there to restrict the builds. 14:17:50 <d-caf> not saying there isn't more work needed, but their is some framework to start from. 14:18:31 <d-caf> additionally there is teh ability to restrict via list-targets and tags which could also be leveraged into this 14:18:58 <d-caf> but it would reguire some changes in the normal path/tagging for these special embargo instances 14:19:22 <d-caf> Bodhi on the other hand, well, that has next to nothing 14:19:40 <d-caf> I don't even really see much of a framework to start from 14:19:40 <Sparks> And then there's distgit 14:19:55 <d-caf> I didn't get to distgit, completey forgot about that. 14:20:28 <Sparks> dgilmore: Okay, your turn. Are we confusing what's being said in the docs? 14:20:41 <d-caf> Koji needs work, but there is framework there to work with, bodhi will need a ton of work. didn't check distgit 14:21:08 <Sparks> #action Sparks to garden the Koji wiki pages to standardize the pages and add a category or two. 14:21:30 <d-caf> #link https://fedoraproject.org/wiki/Koji#Tags_and_Targets 14:22:07 <d-caf> Policy work with tags and targets, need to addes better user support and likely interaction with outside repos 14:22:47 <d-caf> Will also need to consider what access of admins on this system (who "can" see all) with regard to embargos 14:24:29 <Sparks> #action d-caf to continue working on private builds in koji, bodhi, and distgit. 14:24:30 <d-caf> Need to work with people (like dgilmore or pjp ) to help come up with a plan and layout a series of tickets to create to help guide the work 14:24:37 <Sparks> Anything else? 14:25:14 <d-caf> dgilmore: I want your opinions and help, just need to give me a chance to layout my mind :-) (no matter how insane it is sometimes) 14:27:13 <Sparks> Okay, moving on 14:27:27 <Sparks> #topic Windows/OS X Tools in F25 14:27:36 <Sparks> #link https://lists.fedoraproject.org/archives/list/security-team@lists.fedoraproject.org/thread/I7JESRGWRWDXFDGODBUPTUL3KWTXAGVP/ 14:27:43 <Sparks> grrr 14:28:02 <dgilmore> d-caf: sorry was looking at something else 14:28:05 <Sparks> #link https://lists.fedoraproject.org/archives/list/security-team@lists.fedoraproject.org/thread/I7JESRGWRWDXFDGODBUPTUL3KWTXAGVP/ 14:28:23 <Sparks> I just released this message to the list right before the meeting. 14:28:56 <Sparks> It appears that mattdm has asked that we sign off on some tools for Window/OS X users. 14:29:51 <Sparks> The email isn't incredibly detailed as to what the question is. Does someone want to follow up on this? 14:30:26 <d-caf> Sparks: unfortunately I'm going to have to drop out now as I have a realworld meeting. I am very interested in what this windows/osx tool thing is, but can't take lead on it 14:30:31 <d-caf> catch you later. 14:30:37 <Sparks> d-caf: Okay, have a good day. 14:30:49 <Sparks> Anyone else? 14:31:04 <dgilmore> Sparks: the tool is suppopsed to download Fedora isos and install them only a usb stick or disk 14:31:31 <Sparks> Okay, so it's the USB installer thingy that we currently have in Fedora but for Windows and OS X users? 14:31:48 <dgilmore> yeah 14:32:16 <Sparks> dgilmore: Is there a wiki page for this project or is it just living in email right now? 14:32:45 * Sparks isn't sure if we're being asked to review the code or the idea of making Windows/OS X software available. 14:32:50 <dgilmore> it was a accepted f24 change that has been postponed 14:33:25 <dgilmore> Sparks: some people want to build it on computers under their desks 14:33:31 <dgilmore> and ship those binaries 14:33:36 <Sparks> ewww 14:34:12 <dgilmore> I believe what has been asked is that the security team sign off on what level of risk is accepted in how we build and ship it 14:34:14 <Sparks> Do we have the means of compiling the software for non-Linux OSs within our infrastructure? 14:34:33 <dgilmore> Sparks: sounds like you guys need to ask more questions first 14:34:45 <Sparks> dgilmore: Yes 14:35:18 <Sparks> This conversation seems to be not happening on a list. Is there a proper public place to have this discussion? 14:35:26 <dgilmore> koji supports windows natively and it may be possible for to use mingw to cross somplie if they switch to c++ 14:35:59 <dgilmore> Sparks: there is probably a few places it could be happening 14:36:21 <Sparks> dgilmore: Name one and I'll take it there. 14:36:33 <dgilmore> Sparks: Christian is supposed to follow up with a proposal 14:36:33 <Sparks> dgilmore: Otherwise, I'll just try to follow up the best I can. 14:37:34 <dgilmore> Sparks: I think a ticket is needed for the security team side of the discussion 14:37:42 <dgilmore> that is what Matthew asked for 14:38:01 <Sparks> #action Sparks to follow up on the shipping of non-Linux binaries of the USB ISO tool. 14:38:11 <Sparks> #action Sparks to create a ticket for the request 14:38:21 <Sparks> dgilmore: Okay, I'll take care of that, then. Thanks. 14:38:55 <dgilmore> https://fedoraproject.org/wiki/Changes/LUCasPrimaryDownloadable 14:39:03 <dgilmore> thanks Sparks 14:39:19 <Sparks> #link https://fedoraproject.org/wiki/Changes/LUCasPrimaryDownloadable 14:39:33 <Sparks> Okay, moving along 14:39:39 <Sparks> #topic Outstanding BZ Tickets 14:39:40 <dgilmore> Sparks: if you have nothing else on your agenda I would like to give some follow up info on koji 14:39:47 <dgilmore> or at the end 14:39:54 <Sparks> #info Thursday's numbers: Critical 0 (0), Important 88 (+8), Moderate 531 (+11), Low 182 (+2), Total 801 (+21) 14:40:06 <Sparks> dgilmore: Okay, I'll get you some time in just a moment 14:40:12 <Sparks> +Tickets by Severity-+-------+---------+ 14:40:12 <Sparks> | Severity | Tickets | Owned | Unowned | 14:40:12 <Sparks> +----------+---------+-------+---------+ 14:40:12 <Sparks> | medium | 531 | 40 | 491 | 14:40:12 <Sparks> | low | 182 | 13 | 169 | 14:40:14 <Sparks> | high | 88 | 28 | 60 | 14:40:17 <Sparks> +----------+---------+-------+---------+ 14:40:36 <Sparks> I suspect another bug round up would be nice to get these highs down a bit. 14:41:08 <Sparks> mhayden: You know, it would be nice to get some better statistics on these tickets. Where does this code live, again? 14:41:27 <mhayden> the fedora-security-team repo 14:41:32 * Sparks is thinking he might be able to make some additions. 14:41:37 <Sparks> okay 14:41:43 <Sparks> mhayden: I'll send you some patches 14:41:55 <Sparks> Anyone have anything ticket-related to discuss? 14:42:00 <mhayden> hah okay 14:42:54 <Sparks> #topic Private builds in infrastructure for embargoed bits 14:43:02 <Sparks> dgilmore: Okay, go. :) 14:43:29 <dgilmore> Sparks: thanks 14:43:47 <dgilmore> so koji's policys only have effect when doing builds and tagging 14:44:00 <dgilmore> and even then they are not very good 14:44:35 <dgilmore> for instance we can not stop someone doing kernel etc build that is not have the secure-boot permission 14:44:51 <dgilmore> we can only stop that build being tagged anywhere 14:44:56 * linuxmodder back will catch up the interim from minutes 14:45:11 <dgilmore> all read items do not have any policy on them 14:45:45 <dgilmore> setting the policy is very fragile and covers a small subset of things 14:46:20 <Sparks> so far from bullet-proof 14:46:30 <dgilmore> right 14:46:37 <dgilmore> and it does not really confine anything 14:46:47 <dgilmore> it just redirects things 14:47:09 <Sparks> I may be imagining this but didn't you say that this was a feature request that was being investigated already? 14:47:18 <dgilmore> it may be possible to extend it to cover everything needed, but that will be a lot of work 14:47:38 <dgilmore> Sparks: its something that has been asked for since we moved to koji 14:47:48 <Sparks> Okay 14:48:03 <Sparks> A lot of work? What else do you have going on over there? 14:48:05 * Sparks ducks 14:48:10 <dgilmore> and everytime it has been the conculsion has been its too much work, too low a priority for something that will be rarely used 14:48:38 <dgilmore> there is maybe 3 or 4 times a year it wuld be useful 14:48:38 <Sparks> define "rarely" 14:48:44 <Sparks> true 14:48:50 <dgilmore> at least that we know of 14:48:57 <dgilmore> maybe if it was there it would be used more 14:49:06 <dgilmore> openjdk is the big one that would use it 14:49:09 <Sparks> dgilmore: Perhaps I can get more better numbers 14:49:19 <Sparks> dgilmore: Not saying that your numbers are inaccurate 14:49:23 <dgilmore> openssl maybe 14:49:34 <dgilmore> Sparks: there is a lot of unkowns 14:49:39 <dgilmore> that was our guess 14:50:26 <Sparks> dgilmore: I think I can pull out all the critical and important vulns that were embargoed prior to release for last year. 14:50:38 <dgilmore> Sparks: one area that is difficult 14:51:09 <dgilmore> take http://koji.fedoraproject.org/koji/buildinfo?buildID=760088 14:51:20 <dgilmore> it is a java-1.8.0-openjdk build 14:51:27 <dgilmore> say it was embargoed 14:51:44 <dgilmore> and we could hide all evidence of it from koji web 14:52:09 <dgilmore> the rpms and logs all exist https://kojipkgs.fedoraproject.org//packages/java-1.8.0-openjdk/1.8.0.91/5.b14.fc25/ 14:52:26 <dgilmore> you would have to go searching for it 14:52:30 <dgilmore> but it could be found 14:52:35 <Sparks> hmmm 14:52:55 <dgilmore> we likely would have to do something in koji to make that hidden 14:53:10 <dgilmore> but allow people who need to test it have access 14:53:23 <Sparks> correct 14:53:40 <dgilmore> maybe hiding from koji-web is enough 14:53:56 <dgilmore> but allowing the api to expose it and kojipkgs access 14:54:18 <dgilmore> I am not 100% sure how far we have to go in order to ensure that it is not leaked 14:54:34 <dgilmore> so I err on the side of we need to limit all access 14:54:38 <Sparks> Well... I suspect having something out there is too much 14:54:42 <Sparks> yes 14:54:55 <Sparks> Okay, we'll continue to work on this and gather information 14:55:11 <dgilmore> kojipkgs is just apache running serving up data 14:55:17 <Sparks> #action Sparks to get stats on the number of vulns that were embargoed that affected Fedora/EPEL. 14:55:18 <linuxmodder> so kijipkgs access would be what proven packagers? 14:55:24 <dgilmore> there is no application or logic controlling it 14:55:33 <dgilmore> linuxmodder: today its everyone 14:55:59 <dgilmore> something would need to be changed 14:56:19 <dgilmore> maybe instead of /packages they go in /embargo 14:56:23 <linuxmodder> and there is no 'current' way to use fas or kerberos to restrict that ? 14:56:31 <dgilmore> and we have ssl cert auth or something on it 14:56:40 <dgilmore> linuxmodder: not currently 14:57:08 <linuxmodder> so a second Fedora CA cert like koji login needs now ? but only for embargoes? 14:57:10 <dgilmore> putting the output into a different namespace would be invasive in koji 14:57:15 <dgilmore> but would be doable 14:57:32 <linuxmodder> invasive how? 14:57:32 <dgilmore> linuxmodder: perhaps, or maybe just oauth 14:57:55 <linuxmodder> openid == oauth isn't it 14:57:57 <dgilmore> linuxmodder: invasive in that we would need pretty significant code changes in koji to do it 14:58:06 <linuxmodder> ah 14:58:17 <dgilmore> and we would need to then have a way to make it unembargoed that put it in the regular location 14:58:41 <dgilmore> as thats where the tooling that makes repos would need it 14:59:10 <Sparks> Moar tools! 14:59:16 <linuxmodder> dgilmore, couldn't we just make the /embargo RO to 'world' users til some expiry date? 14:59:18 <Sparks> Okay, we're getting to the end of our hour 14:59:28 <linuxmodder> or would that still require more code / tools 14:59:50 <dgilmore> so in summary what d-caf looked at is just a small part of how it could be implemented 15:00:14 <dgilmore> but I guess that is more than dist-git and bodhi have 15:00:31 * linuxmodder still doesn't get dist-git fully 15:01:00 <dgilmore> linuxmodder: dist-git is a few seperate things 15:01:10 <dgilmore> cgit just reads whats on disk 15:01:36 <sct> Time for modularity WG meeting, is the previous meeting still running? 15:01:38 <Sparks> Okay, lets take this to the list or #fedora-security-team. 15:01:52 <sct> Thanks! 15:01:53 <Sparks> Thanks everyone for coming. Catch you all on the tubez! 15:01:56 <Sparks> #endmeeting