4 ms·

Why does a critical utility like this need Python, Ruby, and Perl? Scripting languages intended for applications development, with their interpreters and librar

Why does a critical utility like this need Python, Ruby, and Perl? Scripting languages intended for applications development, with their interpreters and libraries and dependencies, expand the attack surface beyond anyone's ability to consider all of the security holes.

pabs3 2y ago
When you upgrade a Python module to fix a security vulnerability, you need to restart the Python processes that loaded it. So needrestart supports scanning all processes on the system to see if they are Python processes and if they loaded the Python modules that were upgraded. Same goes for Ruby and Perl, microcode and more. The alternative approach is to just reboot after every upgrade like on Windows. That can be disruptive in some situations so needrestart was created to only restart the things that need restarting.
- gregjor 2y ago
  I see. I question the wisdom of using Python, Ruby, Perl etc. for system-level utilities in the first place but that train left the station a long time ago.
- grumpyprole 2y ago
  It still sounds like duct tape to me. An OS should know the dependencies of each service without having to perform complex dynamic scanning to find out. Is this information not already in dpkg?
  - pabs3 2y ago
    You can't know that all services are running apt installed code, or if they are whether they were restarted already, and the dependencies don't encode what each binary loads at runtime. So scanning processes is the correct thing to do.
    - grumpyprole 2y ago
      > So scanning processes is the correct thing to do. Most solutions in engineering involve a trade-off. Clearly this solution trades simplicity for complexity and multiple CVEs. An OS could utilise a known static configuration as described by its packaging system, for a much simpler solution. It could disallow running services any other way.

4 ms·

Why does a critical utility like this need Python, Ruby, and Perl? Scripting languages intended for applications development, with their interpreters and librar

by gregjor 2y ago

pabs3 2y ago
When you upgrade a Python module to fix a security vulnerability, you need to restart the Python processes that loaded it. So needrestart supports scanning all processes on the system to see if they are Python processes and if they loaded the Python modules that were upgraded. Same goes for Ruby and Perl, microcode and more. The alternative approach is to just reboot after every upgrade like on Windows. That can be disruptive in some situations so needrestart was created to only restart the things that need restarting.
- gregjor 2y ago
  I see. I question the wisdom of using Python, Ruby, Perl etc. for system-level utilities in the first place but that train left the station a long time ago.
- grumpyprole 2y ago
  It still sounds like duct tape to me. An OS should know the dependencies of each service without having to perform complex dynamic scanning to find out. Is this information not already in dpkg?
  - pabs3 2y ago
    You can't know that all services are running apt installed code, or if they are whether they were restarted already, and the dependencies don't encode what each binary loads at runtime. So scanning processes is the correct thing to do.
    - grumpyprole 2y ago
      > So scanning processes is the correct thing to do. Most solutions in engineering involve a trade-off. Clearly this solution trades simplicity for complexity and multiple CVEs. An OS could utilise a known static configuration as described by its packaging system, for a much simpler solution. It could disallow running services any other way.