Fedora 8 security flaws in Bugzilla

[Lubomir Kundrak]

Hi all,

When Fedora 8 is out, the number of issues that affect two supported
Fedora releases will raise. Currently issues are  usually either common
for Fedora Core 6 and some releases RHEL, (where the package is
typically owned by a Red Hat employee who has to care about fixing the
bug in supported products) or specific to what used to be Fedora Extras
and Fedora 7.

Traditionally, I did not use to care about Extras, but situation changed
when Fedora 7 was out with Extras merged in. With Fedora 8 most issues
will affect two Fedora releases and I am curious how are we going to
track the issues in Bugzilla, and how will Bodhi -- the update system
deal with it.

1.) We could clone bug for each supported release. This would be a bit
impractical, because of redundant information and comments that would go
to two different places. But this will play nicely with Bodhi and
references in the update mails.

2.) We could file a bug in the Security Response product and create
private tracking bugs. For Bodhi to be happy we would reference both
parent bug and tracking bugs. Downside would be that developer would be
confused with three bugs filed for one issue. Maybe the Description in
the tracking bug would clarify this to him.

3.) Create a bug for Fedora devel and then use flags to denote which
releases need fixing and/or were fixed; Maybe something like
fc7-fixed, fc8-fixed with values like " " = don't know if is affected,
"-" = doesn't need fixing, "?" = need fixing, "+" fixed.
Bodhi could be
made to respect the flags and only close the bugs if nothing = "?".
Downside would be assignee -- packages don't have to be owned by the
same owner in all branches.

Or are we going to handle that in another way? SFM?

Cheers,
-- 
Lubomir Kundrak (Security Response Team)
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
Registered in Brno under #CZ27690016

[Jason L Tibbitts III]

> >>>> "LK" == Lubomir Kundrak
> <lkundrak(a)redhat.com&gt; writes: 
LK> Or are we going to handle that in another way? SFM?

If the problem is bodhi closing bugs that may need to remain open to
track the issue in different branches, wouldn't it be far simpler for
bodhi to grow the option to just not close referenced tickets?  That
way we could record information about which branches have been fixed
in a freeform manner and not push a ton of flags or cloned tickets.

 - J<

[Lubomir Kundrak]

On Wed, 2007-08-29 at 10:40 -0500, Jason L Tibbitts III wrote:
>  >>>>> "LK" == Lubomir Kundrak
> <lkundrak(a)redhat.com&gt; writes:
>  
>  LK> Or are we going to handle that in another way? SFM?
>  
>  If the problem is bodhi closing bugs that may need to remain open to
>  track the issue in different branches, wouldn't it be far simpler for
>  bodhi to grow the option to just not close referenced tickets?  That
>  way we could record information about which branches have been fixed
>  in a freeform manner and not push a ton of flags or cloned tickets. 
If we went the flags way, it would imply modification similar to this to
Bodhi.

>   - J< 
-- 
Lubomir Kundrak (Security Response Team)
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
Registered in Brno under #CZ27690016

[Kevin Fenzi]

On Wed, 29 Aug 2007 18:02:21 +0200
Lubomir Kundrak <lkundrak(a)redhat.com&gt; wrote:

>  On Wed, 2007-08-29 at 10:40 -0500, Jason L Tibbitts III wrote:
>  > >>>>> "LK" == Lubomir Kundrak <lkundrak(a)redhat.com&gt;
> writes:
>  > 
>  > LK> Or are we going to handle that in another way? SFM?
>  > 
>  > If the problem is bodhi closing bugs that may need to remain open to
>  > track the issue in different branches, wouldn't it be far simpler
>  > for bodhi to grow the option to just not close referenced tickets?
>  > That way we could record information about which branches have been
>  > fixed in a freeform manner and not push a ton of flags or cloned
>  > tickets.
>  
>  If we went the flags way, it would imply modification similar to this
>  to Bodhi. 
So there would need to be a flag for each supported release? 
Not sure if bugzilla can handle that. I seem to remember that the
number of flags that can exist was limited. 

If however it can do this that might be a nice way to track things... 

Also, it would be nice if we added an alias for the CVE for a bug... so
we could go to https://bugzilla.redhat.com/CVE-2007-NNNNN and get the
bug. 

There was discussion about having someone from the security team ack
'Security' marked bugs in bodhi before they are pushed out. If we get
that in place, we could just have that person close the bug, rather
than have bodhi do so.

kevin

[Lubomir Kundrak]

On Wed, 2007-08-29 at 13:41 -0600, Kevin Fenzi wrote:
>  On Wed, 29 Aug 2007 18:02:21 +0200
>  Lubomir Kundrak <lkundrak(a)redhat.com&gt; wrote:
>  
>  > On Wed, 2007-08-29 at 10:40 -0500, Jason L Tibbitts III wrote:
>  > > >>>>> "LK" == Lubomir Kundrak
> <lkundrak(a)redhat.com&gt; writes:
>  > > 
>  > > LK> Or are we going to handle that in another way? SFM?
>  > > 
>  > > If the problem is bodhi closing bugs that may need to remain open to
>  > > track the issue in different branches, wouldn't it be far simpler
>  > > for bodhi to grow the option to just not close referenced tickets?
>  > > That way we could record information about which branches have been
>  > > fixed in a freeform manner and not push a ton of flags or cloned
>  > > tickets.
>  > 
>  > If we went the flags way, it would imply modification similar to this
>  > to Bodhi.
>  
>  So there would need to be a flag for each supported release? 
>  Not sure if bugzilla can handle that. I seem to remember that the
>  number of flags that can exist was limited. 
>  
>  If however it can do this that might be a nice way to track things...  
I am thinking that when FC-34 comes out, it won't be nice to see empty
flags for the unsupported releases. Probably the tracking bugs way with
explanation for developer how to handle the security issue (and link to
wiki page about handling Fedora security issues) would be nicer.

>  Also, it would be nice if we added an alias for the CVE for a bug...
> so
>  we could go to https://bugzilla.redhat.com/CVE-2007-NNNNN and get the
>  bug.  
Yes, we do that already. Moreover, we get most bugs we file against
Fedora from CVE. I'll commit a script that clones bugs from CVE into
bugzilla just as I make it independent from internal Red Hat tools.

>  There was discussion about having someone from the security team ack
>  'Security' marked bugs in bodhi before they are pushed out. If we get
>  that in place, we could just have that person close the bug, rather
>  than have bodhi do so. 
The ack from security response would be in place primarily to ensure
that all references to CVE and bugzilla are in place and correct.

I'd rather prefer Bodhi do that and also add a nice comment. There are
also other things I'd like Bodhi to do to make the process more
consistent, I'll post that list once it is complete and request feature
enhancement.

>  kevin 
Regards,
-- 
Lubomir Kundrak (Security Response Team)
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
Registered in Brno under #CZ27690016

[Luke Macken]

On Wed, Aug 29, 2007 at 01:41:01PM -0600, Kevin Fenzi wrote:
>  There was discussion about having someone from the security team ack
>  'Security' marked bugs in bodhi before they are pushed out. If we get
>  that in place, we could just have that person close the bug, rather
>  than have bodhi do so. 
This needs to get approved by FESCo before it is implemented in bodhi.
(It's actually partially implemented, and commented out at the moment).

luke

[Lubomir Kundrak]

On Thu, 2007-08-30 at 15:49 -0400, Luke Macken wrote:
>  On Wed, Aug 29, 2007 at 01:41:01PM -0600, Kevin Fenzi wrote:
>  > There was discussion about having someone from the security team ack
>  > 'Security' marked bugs in bodhi before they are pushed out. If we get
>  > that in place, we could just have that person close the bug, rather
>  > than have bodhi do so.
>  
>  This needs to get approved by FESCo before it is implemented in bodhi.
>  (It's actually partially implemented, and commented out at the moment). 
I know. It wasn't discussed in FESCo due to time shortage, I was told to
post it for comments on fedora-devel-list@ (by Jessie Keating) and I
will do that shortly.

>  luke
>  
>  --
>  Fedora-security-list mailing list
>  Fedora-security-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-security-list 
-- 
Lubomir Kundrak (Security Response Team)
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
Registered in Brno under #CZ27690016

[Till Maas]

On Mi August 29 2007, Jason L Tibbitts III wrote:

>  track the issue in different branches, wouldn't it be far simpler
> for
>  bodhi to grow the option to just not close referenced tickets?  
This option will be in Fedora's Bodhi once it gets updated afaik, which was 
planned for last week iirc.

Regards,
Till

[Luke Macken]

On Wed, Aug 29, 2007 at 10:40:32AM -0500, Jason L Tibbitts III wrote:
>  >>>>> "LK" == Lubomir Kundrak
> <lkundrak(a)redhat.com&gt; writes:
>  
>  LK> Or are we going to handle that in another way? SFM?
>  
>  If the problem is bodhi closing bugs that may need to remain open to
>  track the issue in different branches, wouldn't it be far simpler for
>  bodhi to grow the option to just not close referenced tickets?  That
>  way we could record information about which branches have been fixed
>  in a freeform manner and not push a ton of flags or cloned tickets. 
I implemented this feature a little while back.  You'll see it in the
next production upgrade.

luke