Stanislav Ochotnicky | 14 Jun 2012 14:59
Picon
Favicon
Gravatar

Accidentally enabled service after update from F16 to F17 - solutions?

So...I've transitioned jetty to systemd in F17. However during the
transition I made a terribly stupid thing: enabled the service by
default, which really was an accident (#831280).

This only happens on systems which had jetty installed on F16 and
updated to F17. Since jetty is eclipse dependency a lot of development
machines will have this as well.

Now, I've prepared a patch (attached) that should fix the issue. There
is however one part of it which I'd like to ask opinions about:

+# bug 831280, needs to stay here until F19
+# users should enable jetty themselves. It was enabled accidentaly
+%triggerun -- jetty < 8.1.2-9
+/bin/systemctl --no-reload disable jetty.service >/dev/null 2>&1 ||:
+/bin/systemctl --no-reload stop jetty.service >/dev/null 2>&1 ||:

This trigger will do following:
If we are updating from previous releases, we disable the service and
stop it if it's running

The first line of the trigger is not very controversial I'd say. If the
user hasn't enabled the service, it should be disabled by default.
We have no way to know if the user wanted this enabled, or not. He might
have even had it enabled in F16 and we disable this for him. Not an
ideal solution, however leaving it be would result in having
potentionally insecure web server running by default on a lot of
machines.

The second line...well not sure here. Since I don't want to wait for
(Continue reading)

Michal Schmidt | 14 Jun 2012 15:10
Picon
Favicon

Re: Accidentally enabled service after update from F16 to F17 - solutions?

On 06/14/2012 02:59 PM, Stanislav Ochotnicky wrote:
> +%triggerun -- jetty < 8.1.2-9

You already have one triggerun for jetty in the spec:
%triggerun -- jetty < 8.1.0-3

You're likely to hit this RPM bug:
https://bugzilla.redhat.com/show_bug.cgi?id=702378

> +/bin/systemctl --no-reload disable jetty.service >/dev/null 2>&1 ||:
> +/bin/systemctl --no-reload stop jetty.service >/dev/null 2>&1 ||:
>
> This trigger will do following:
> If we are updating from previous releases, we disable the service and
> stop it if it's running

I dislike this, because:
  - You'd just break some users' systems for the sake of a different
    subset of users.
  - Some breakage during distribution upgrade is more tolerable than
    breakage within regular updates.

Is a running jetty really _that_ dangerous? Why do we ship it at all 
then? ;-)

Michal
--

-- 
devel mailing list
devel <at> lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
(Continue reading)

Stanislav Ochotnicky | 14 Jun 2012 16:19
Picon
Favicon
Gravatar

Re: Accidentally enabled service after update from F16 to F17 - solutions?

Quoting Michal Schmidt (2012-06-14 15:10:56)
> On 06/14/2012 02:59 PM, Stanislav Ochotnicky wrote:
> > +%triggerun -- jetty < 8.1.2-9
> 
> You already have one triggerun for jetty in the spec:
> %triggerun -- jetty < 8.1.0-3
> 
> You're likely to hit this RPM bug:
> https://bugzilla.redhat.com/show_bug.cgi?id=702378
> 

I guess this in itself solves the problem for us. We can't fix user
systems properly ergo...

> > +/bin/systemctl --no-reload disable jetty.service >/dev/null 2>&1 ||:
> > +/bin/systemctl --no-reload stop jetty.service >/dev/null 2>&1 ||:
> >
> > This trigger will do following:
> > If we are updating from previous releases, we disable the service and
> > stop it if it's running
> 
> I dislike this, because:
>   - You'd just break some users' systems for the sake of a different
>     subset of users.
>   - Some breakage during distribution upgrade is more tolerable than
>     breakage within regular updates.

Well not anymore, I'll just describe it in the bodhi update.

> Is a running jetty really _that_ dangerous? Why do we ship it at all 
(Continue reading)

Michal Schmidt | 14 Jun 2012 17:16
Picon
Favicon

Re: Accidentally enabled service after update from F16 to F17 - solutions?

On 06/14/2012 04:19 PM, Stanislav Ochotnicky wrote:
> Quoting Michal Schmidt (2012-06-14 15:10:56)
>> Is a running jetty really _that_ dangerous? Why do we ship it at all
>> then? ;-)
>
> Why do we ship Apache, tomcat and tens (hundrets?) of other useful
> packages? Jetty unlike most packages _is_ remotely accessible so the
> attack surface is rather large.
>
> If you wrote that in a jest, then sorry but I don't take my mistake that
> could compromise security of Fedora's users that lightly.

I thought the winking smiley gave it away.

But there is a basis for my jesting comment: It's great that you take 
security seriously, but I believe you're over-estimating the danger of 
the running service.
Fedora has a firewall enabled by default. And I trust that the service 
receives any applicable security updates. The users' systems are not 
compromised.

Michal
--

-- 
devel mailing list
devel <at> lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel

Gmane