[PATCH 0/2] supermin: use /etc/os-release
Hi, let's make supermin use /etc/os-release as primary source instead of the various release files in /etc; apparently distros (e.g. openSUSE) are starting removing them. Thanks, Pino Toscano (2): Add simple handling of /etc/os-release Use os-release to detect the distro src/Makefile.am | 3 +++ src/dpkg.ml | 3 ++- src/os_release.ml | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/os_release.mli | 26 ++++++++++++++++++ src/pacman.ml | 5 ++-- src/rpm.ml | 15 ++++++----- 6 files changed, 121 insertions(+), 9 deletions(-) create mode 100644 src/os_release.ml create mode 100644 src/os_release.mli -- 2.7.4
Introduce a simple module to read and cache fields of /etc/os-release that might be needed, and there is only ID for now. --- src/Makefile.am | 3 +++ src/os_release.ml | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/os_release.mli | 26 ++++++++++++++++++ 3 files changed, 107 insertions(+) create mode 100644 src/os_release.ml create mode 100644 src/os_release.mli diff --git a/src/Makefile.am b/src/Makefile.am index 11adf31..767117f 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -47,6 +47,8 @@ SOURCES = \ utils.ml \ utils.mli \ types.ml \ + os_release.ml \ + os_release.mli \ package_handler.ml \ package_handler.mli \ rpm.ml \ @@ -71,6 +73,7 @@ SOURCES_ML = \ config.ml \ utils.ml \ types.ml \ + os_release.ml \ package_handler.ml \ rpm.ml \ dpkg.ml \ diff --git a/src/os_release.ml b/src/os_release.ml new file mode 100644 index 0000000..b2de259 --- /dev/null +++ b/src/os_release.ml @@ -0,0 +1,78 @@ +(* supermin 5 + * Copyright (C) 2016 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + *) + +open Utils + +let split sep str = + let len = String.length sep in + let seplen = String.length str in + let i = find str sep in + if i = -1 then str, "" + else ( + String.sub str 0 i, String.sub str (i + len) (seplen - i - len) + ) + +type os_release = { + id : string; +} + +let data = ref None +let parsed = ref false + +let rec get_data () = + if !parsed = false then ( + data := parse (); + parsed := true; + ); + + !data + +and parse () = + let file = "/etc/os-release" in + if Sys.file_exists file then ( + let chan = open_in file in + let lines = input_all_lines chan in + close_in chan; + let lines = List.filter ((<>) "") lines in + let lines = List.filter (fun s -> s.[0] <> '#') lines in + + let id = ref "" in + + List.iter ( + fun line -> + let field, value = split "=" line in + let value = + let len = String.length value in + if len > 1 && + ((value.[0] = '"' && value.[len-1] = '"') || + (value.[0] = '\'' && value.[len-1] = '\'')) then + String.sub value 1 (len - 2) + else value in + match field with + | "ID" -> id := value + | _ -> () + ) lines; + + Some { id = !id; } + ) else + None + +let get_id () = + match get_data () with + | None -> "" + | Some d -> d.id diff --git a/src/os_release.mli b/src/os_release.mli new file mode 100644 index 0000000..2ae349b --- /dev/null +++ b/src/os_release.mli @@ -0,0 +1,26 @@ +(* supermin 5 + * Copyright (C) 2016 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + *) + +(** Handling of /etc/os-release. *) + +val get_id : unit -> string +(** Get the value of the "ID" field from the /etc/os-release file + on the current system. + + An empty string is returned if the file does not exist or cannot + be read. *) -- 2.7.4
Check the ID field in /etc/os-release on the current system, before checking for the other old-style release-/version-like files in /etc. Some distributions (openSUSE Thumbleweed) are starting to remove them, breaking the supermin detection. --- src/dpkg.ml | 3 ++- src/pacman.ml | 5 +++-- src/rpm.ml | 15 +++++++++------ 3 files changed, 14 insertions(+), 9 deletions(-) diff --git a/src/dpkg.ml b/src/dpkg.ml index 70acfa2..1e785de 100644 --- a/src/dpkg.ml +++ b/src/dpkg.ml @@ -28,7 +28,8 @@ let dpkg_detect () = Config.dpkg_query <> "no" && Config.dpkg_divert <> "no" && Config.apt_get <> "no" && - try (stat "/etc/debian_version").st_kind = S_REG with Unix_error _ -> false + (List.mem (Os_release.get_id ()) [ "debian"; "ubuntu" ] || + try (stat "/etc/debian_version").st_kind = S_REG with Unix_error _ -> false) let dpkg_primary_arch = ref "" let settings = ref no_settings diff --git a/src/pacman.ml b/src/pacman.ml index 3340fa6..c35668a 100644 --- a/src/pacman.ml +++ b/src/pacman.ml @@ -24,8 +24,9 @@ open Package_handler let pacman_detect () = Config.pacman <> "no" && Config.fakeroot <> "no" && - (stat "/etc/arch-release").st_kind = S_REG && - Config.pacman_g2 = "no" (* not Frugalware with pacman-g2 *) + (Os_release.get_id () = "arch" || + ((stat "/etc/arch-release").st_kind = S_REG && + Config.pacman_g2 = "no")) (* not Frugalware with pacman-g2 *) let settings = ref no_settings diff --git a/src/rpm.ml b/src/rpm.ml index a5dc67a..e409e37 100644 --- a/src/rpm.ml +++ b/src/rpm.ml @@ -31,21 +31,24 @@ let stringset_of_list pkgs = let fedora_detect () = Config.rpm <> "no" && Config.rpm2cpio <> "no" && rpm_is_available () && (Config.yumdownloader <> "no" || Config.dnf <> "no") && - try - (stat "/etc/redhat-release").st_kind = S_REG || - (stat "/etc/fedora-release").st_kind = S_REG - with Unix_error _ -> false + (List.mem (Os_release.get_id ()) [ "fedora"; "rhel"; "centos" ] || + try + (stat "/etc/redhat-release").st_kind = S_REG || + (stat "/etc/fedora-release").st_kind = S_REG + with Unix_error _ -> false) let opensuse_detect () = Config.rpm <> "no" && Config.rpm2cpio <> "no" && rpm_is_available () && Config.zypper <> "no" && - try (stat "/etc/SuSE-release").st_kind = S_REG with Unix_error _ -> false + (List.mem (Os_release.get_id ()) [ "opensuse"; "sled"; "sles" ] || + try (stat "/etc/SuSE-release").st_kind = S_REG with Unix_error _ -> false) let mageia_detect () = Config.rpm <> "no" && Config.rpm2cpio <> "no" && rpm_is_available () && Config.urpmi <> "no" && Config.fakeroot <> "no" && - try (stat "/etc/mageia-release").st_kind = S_REG with Unix_error _ -> false + (Os_release.get_id () = "mageia" || + try (stat "/etc/mageia-release").st_kind = S_REG with Unix_error _ -> false) let ibm_powerkvm_detect () = Config.rpm <> "no" && Config.rpm2cpio <> "no" && rpm_is_available () && -- 2.7.4
On Wed, 2016-08-31 at 15:05 +0200, Pino Toscano wrote:
Check the ID field in /etc/os-release on the current system, before checking for the other old-style release-/version-like files in /etc. Some distributions (openSUSE Thumbleweed) are starting to remove them, breaking the supermin detection. --- src/dpkg.ml | 3 ++- src/pacman.ml | 5 +++-- src/rpm.ml | 15 +++++++++------ 3 files changed, 14 insertions(+), 9 deletions(-)
diff --git a/src/dpkg.ml b/src/dpkg.ml index 70acfa2..1e785de 100644 --- a/src/dpkg.ml +++ b/src/dpkg.ml @@ -28,7 +28,8 @@ let dpkg_detect () = Config.dpkg_query <> "no" && Config.dpkg_divert <> "no" && Config.apt_get <> "no" && - try (stat "/etc/debian_version").st_kind = S_REG with Unix_error _ -> false + (List.mem (Os_release.get_id ()) [ "debian"; "ubuntu" ] || + try (stat "/etc/debian_version").st_kind = S_REG with Unix_error _ -> false) let dpkg_primary_arch = ref "" let settings = ref no_settings diff --git a/src/pacman.ml b/src/pacman.ml index 3340fa6..c35668a 100644 --- a/src/pacman.ml +++ b/src/pacman.ml @@ -24,8 +24,9 @@ open Package_handler let pacman_detect () = Config.pacman <> "no" && Config.fakeroot <> "no" && - (stat "/etc/arch-release").st_kind = S_REG && - Config.pacman_g2 = "no" (* not Frugalware with pacman-g2 *) + (Os_release.get_id () = "arch" || + ((stat "/etc/arch-release").st_kind = S_REG && + Config.pacman_g2 = "no")) (* not Frugalware with pacman-g2 *) let settings = ref no_settings diff --git a/src/rpm.ml b/src/rpm.ml index a5dc67a..e409e37 100644 --- a/src/rpm.ml +++ b/src/rpm.ml @@ -31,21 +31,24 @@ let stringset_of_list pkgs = let fedora_detect () = Config.rpm <> "no" && Config.rpm2cpio <> "no" && rpm_is_available () && (Config.yumdownloader <> "no" || Config.dnf <> "no") && - try - (stat "/etc/redhat-release").st_kind = S_REG || - (stat "/etc/fedora-release").st_kind = S_REG - with Unix_error _ -> false + (List.mem (Os_release.get_id ()) [ "fedora"; "rhel"; "centos" ] || + try + (stat "/etc/redhat-release").st_kind = S_REG || + (stat "/etc/fedora-release").st_kind = S_REG + with Unix_error _ -> false) let opensuse_detect () = Config.rpm <> "no" && Config.rpm2cpio <> "no" && rpm_is_available () && Config.zypper <> "no" && - try (stat "/etc/SuSE-release").st_kind = S_REG with Unix_error _ -> false + (List.mem (Os_release.get_id ()) [ "opensuse"; "sled"; "sles" ] || + try (stat "/etc/SuSE-release").st_kind = S_REG with Unix_error _ -> false) let mageia_detect () = Config.rpm <> "no" && Config.rpm2cpio <> "no" && rpm_is_available () && Config.urpmi <> "no" && Config.fakeroot <> "no" && - try (stat "/etc/mageia-release").st_kind = S_REG with Unix_error _ -> false + (Os_release.get_id () = "mageia" || + try (stat "/etc/mageia-release").st_kind = S_REG with Unix_error _ -> false) let ibm_powerkvm_detect () = Config.rpm <> "no" && Config.rpm2cpio <> "no" && rpm_is_available () &&
Looks good to me, at least for the openSUSE / SLE parts. -- Cedric
Check the ID in /etc/os-release before checking the other release files, so it's possible to handle distros without them. Also, make sure it is skipped if the value read from os-release is not handled when getting the list of packages. --- tests/test-harder.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/tests/test-harder.sh b/tests/test-harder.sh index ea5dfc8..7e1b8df 100755 --- a/tests/test-harder.sh +++ b/tests/test-harder.sh @@ -25,7 +25,14 @@ set -e # NOTE: This test will only work if the $pkgs listed below # for your distro are installed on the host. SEE LIST BELOW. -if [ -f /etc/arch-release ]; then +if [ -f /etc/os-release ]; then + distro=$(. /etc/os-release && echo $ID) + case "$distro" in + fedora|rhel|centos) distro=redhat ;; + opensuse|sled|sles) distro=suse ;; + ubuntu) distro=debian ;; + esac +elif [ -f /etc/arch-release ]; then distro=arch elif [ -f /etc/debian_version ]; then distro=debian @@ -63,6 +70,10 @@ case $distro in ibm-powerkvm) pkgs="augeas hivex tar" ;; + *) + echo "Unhandled distro '$distro'" + exit 77 + ;; esac test "$USE_NETWORK" = 1 || USE_INSTALLED=--use-installed -- 2.7.4
Greetings, I built a small proof-of-concept and I've been suggested to share it with the community. The tool consists of a vulnerability scanner based on Libguestfs. The tool lists all the installed applications within a disk image and queries a CVE database via REST interface. The data gets aggregated in order to provide a report of the vulnerable applications within the disk image. Here's a concrete example: http://pastebin.com/w6DZkwCg A possible use case could be the vulnerability assessment and management of Cloud instances. The tool is part of a library I've been building to help automating security assessment and forensics analysis of disk images. https://github.com/noxdafox/vminspect I did not test it much yet. Therefore, it might raise several false positives or miss important vulnerabilities but considering it's ~ 100 lines of Python code, I'd say is a good starting point. The tool is relying on cve-search REST APIs to retrieve the vulnerability list. https://github.com/adulau/cve-search
On Wed, 2016-08-31 at 15:05 +0200, Pino Toscano wrote:
Hi,
let's make supermin use /etc/os-release as primary source instead of the various release files in /etc; apparently distros (e.g. openSUSE) are starting removing them.
Thanks,
Pino Toscano (2): Add simple handling of /etc/os-release Use os-release to detect the distro
src/Makefile.am | 3 +++ src/dpkg.ml | 3 ++- src/os_release.ml | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/os_release.mli | 26 ++++++++++++++++++ src/pacman.ml | 5 ++-- src/rpm.ml | 15 ++++++----- 6 files changed, 121 insertions(+), 9 deletions(-) create mode 100644 src/os_release.ml create mode 100644 src/os_release.mli
ACK to the whole series. Just tested it and backported it to Factory packages. openSUSE updated supermin package will arrive soon. -- Cedric
On Wed, Aug 31, 2016 at 03:05:34PM +0200, Pino Toscano wrote:
Hi,
let's make supermin use /etc/os-release as primary source instead of the various release files in /etc; apparently distros (e.g. openSUSE) are starting removing them.
Thanks,
Pino Toscano (2): Add simple handling of /etc/os-release Use os-release to detect the distro
src/Makefile.am | 3 +++ src/dpkg.ml | 3 ++- src/os_release.ml | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/os_release.mli | 26 ++++++++++++++++++ src/pacman.ml | 5 ++-- src/rpm.ml | 15 ++++++----- 6 files changed, 121 insertions(+), 9 deletions(-) create mode 100644 src/os_release.ml create mode 100644 src/os_release.mli
Yes, this looks good. ACK series. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com libguestfs lets you edit virtual machines. Supports shell scripting, bindings from many languages. http://libguestfs.org
participants (4)
-
Cedric Bosdonnat -
noxdafox -
Pino Toscano -
Richard W.M. Jones