Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1518754 - [F28 change] audit should not require tcp_wrappers
Summary: [F28 change] audit should not require tcp_wrappers
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: audit
Version: 28
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Steve Grubb
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1495181 1596070
TreeView+ depends on / blocked
 
Reported: 2017-11-29 14:46 UTC by Jakub Jelen
Modified: 2018-06-28 08:10 UTC (History)
1 user (show)

Fixed In Version: audit-2.8.3-1.fc27 audit-2.8.3-2.fc28
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-01 19:05:40 UTC


Attachments (Terms of Use)

Description Jakub Jelen 2017-11-29 14:46:39 UTC
As announced earlier this year, we plan to deprecate TCP wrappers out of Fedora services in a single release (Fedora 28) to avoid user confusion that some of the tools will be using it and some not.

For more information about the change or possible migration paths outside of the package itself, see the linked accepted Fedora 28 change.

This report is for a source package, that has "BuildRequires tcp_wrappers" in spec file and resulting packages depend on "libwrap.so.0". The changes to remove the dependency should be minimal, usually a configure switch, but let me know if you will need some assistance with the changes.

Additional info:

https://fedoraproject.org/wiki/Changes/Deprecate_TCP_wrappers

Comment 1 Steve Grubb 2017-11-29 16:04:03 UTC
Hmm...reading that document seems that its misses some points. One is that it assumes that blocking traffic is the prime purpose. The reality is that it was created to verify that forward and reverse lookup paths of the connection match. Firewalls cannot do that.

The reason there hasn't been any updates in 20 years is because its a mature piece of code that needs little maintenance. Also, there have been a number of iptables failures over the years where tcp_wrappers was the only thing preventing disaster.

I personally do not think it is wise to dump tcp_wrappers.

Comment 2 Jakub Jelen 2017-11-30 09:51:36 UTC
Hello Steve,
this was the reason why it was discussed earlier before filling the Fedora change and filling the bugs more than 3 months ago [1]. If I see right, you were directly in CC of that message as every other maintainer of affected packages.

Certainly, in the past it was useful, but these days, most of the tools already do the reverse lookups [2] and traffic blocking on their own. But this should not be anything we should depend on. There are other secure ways to verify your peer is really who claims to be.

[1] https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/LGTBBFKUZ62TWEPNX6JZZV56PIUVO3NT/
[2] https://github.com/openssh/openssh-portable/blob/9145a73/auth.c#L762

Comment 3 Steve Grubb 2018-02-13 14:58:34 UTC
I totally disagree with the premise that IPTables is good enough. However, tcp_wrappers-devel is now gone and building audit requires the removal. Audit is now built without tcp_wrappers support.

Comment 4 Fedora End Of Life 2018-02-20 15:31:53 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle.
Changing version to '28'.

Comment 5 Fedora Update System 2018-03-10 12:23:39 UTC
audit-2.8.3-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c1484e4cd

Comment 6 Fedora Update System 2018-03-10 12:23:56 UTC
audit-2.8.3-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ea91f55218

Comment 7 Fedora Update System 2018-03-11 03:05:14 UTC
audit-2.8.3-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c1484e4cd

Comment 8 Fedora Update System 2018-03-11 21:00:00 UTC
audit-2.8.3-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ea91f55218

Comment 9 Jakub Jelen 2018-03-12 09:05:24 UTC
This was intended as a Fedora 28 change so it should not have been pushed to Fedora 27 to avoid exposing users who configured tcp_wrappers and depend on this functionality, if you still consider it as an important part of audit system.

Comment 10 Steve Grubb 2018-03-12 09:26:14 UTC
This is a limitation of Bodhi's interface for doing one note for multiple packages. F27 update was not done by git merge master. It was hand edited to preserve the old settings. There was another big change of renaming audit-lib-python to audit-libs-python2 and I didn't want that to bleed into F27 either. If you want to verify, you can checkout the audit package and switch to the F27 branch and look at it.

Comment 11 Jakub Jelen 2018-03-12 10:49:39 UTC
I was hoping so that you took a care of that, but I wanted to make sure. Thank you for clarification.

Comment 12 Fedora Update System 2018-03-13 23:20:48 UTC
audit-2.8.3-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Kevin Kofler 2018-03-15 00:45:20 UTC
FYI, the update gets split into separate updates per release anyway, so you could have filed 2 separate updates with separate notes, or edited the notes for the F27 updates (after the automatic split) to match reality.

Comment 14 Fedora Update System 2018-03-26 21:31:47 UTC
audit-2.8.3-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c1484e4cd

Comment 15 Fedora Update System 2018-03-27 17:52:09 UTC
audit-2.8.3-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c1484e4cd

Comment 16 Fedora Update System 2018-04-01 19:05:40 UTC
audit-2.8.3-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.