- Package:
- sane-utils
- Source:
- sane-backends
- Description:
- API library for scanners -- utilities
- Submitter:
- David Ward
- Date:
- 2022-03-10 22:45:03 UTC
- Severity:
- normal
- Tags:
saned is a daemon used to share scanners over the networks. This belongs in its own package. Users should be able to install and run the other command-line utilities - in particular, scanimage - without installing saned (even if it is disabled). This is analogous to cupsd, which is provided in a separate package from the rest of CUPS. As with any daemon, there is an attack surface with saned*. Also note that there are Debian-based containers which make use of scanimage but not saned, and these could benefit from splitting it. I would suggest this be achieved as follows: 1) move all files related to saned out of "sane-utils", and into a new package named "sane-dameon"; 2) move all remaining files out of "sane-utils", and into a new package named "libsane-utils"; 3) retain "sane-utils" as a virtual package that depends on both packages above, to ensure upgrades work as expected. Thank you, David * https://www.debian.org/lts/security/2017/dla-940.en.html
Hello David, thank you for spending your time helping to make Debian better with this bug report. I already thought about splitting the packages during the transition to libsane1. Unlike cups, which hardly makes sense without a daemon, saned is not absolutely necessary. Also, saned is not activated by default during installation. So I don't see any problem in the installation, even from a security point of view. As in bug #987800, I therefore see no reason for splitting. So I close this bug. CU Jörg
Hello David, thank you for spending your time helping to make Debian better with this bug report. I already thought about splitting the packages during the transition to libsane1. Unlike cups, which hardly makes sense without a daemon, saned is not absolutely necessary. Also, saned is not activated by default during installation. So I don't see any problem in the installation, even from a security point of view. As in bug #987800, I therefore see no reason for splitting. So I close this bug. CU Jörg
That is exactly why we should split it out as a separate package. The user should be able to choose not to install saned, without that choice preventing the user from running scanimage. I would very kindly point out that Fedora and Red Hat do split these out as separate packages. Also, saned is not activated by default during installation. So I don't see That is not the reality of how organizations approach security though. Even if the daemon is not activated, it may still be a compliance issue to have a daemon with a known vulnerability present on the system at all. It is best to not install daemons that are never used, in order to reduce the amount of time spent applying security updates to unused software. This also did not address my point about Debian-based Docker containers which use scanimage, such as scanservjs. Containers often try to include only the minimum software required, and typically they do not even have systemd or any init system. As in bug #987800, I therefore see no reason for splitting. I am in the process of submitting a merge request for the Debian packaging files. Could you kindly keep this bug open, and let's take a look at that once I submit it? Thank you, David
The following changes since commit 14e37bc19c5065d445e0b2dc405c3144331c5660: d/changelog: Change distribution to unstable, Change date and time (2022-02-07 20:37:06 +0100) are available in the Git repository at: https://salsa.debian.org/dpward/sane-backends.git develop for you to fetch changes up to ac8816eb1dabbaf4b303edf52a1c0cb4e9fd45a7: d/*.README.Debian: Adjust to reflect current permissions (2022-02-13 22:22:46 -0500)---------------------------------------------------------------- David Ward (9): Move sane-umax_pp(5) to libsane-common, and remove umax_pp(5) symlink d/rules: Replace override_dh_installman-* with explicit file lists d/rules: Use override_dh_auto_install-arch for removing rpaths Split sane-utils package into sane-daemon and libsane-utils d/sane-daemon.postrm: Do not delete scanner group Remove leftover handling related to RUN parameter d/*.README.Debian: Fix references to the libsane1 package d/*.README.Debian: Fix instructions for sysvinit d/*.README.Debian: Adjust to reflect current permissions debian/changelog | 28 ++++++++ debian/control | 73 ++++++++++++++++---- .../{sane-utils.install => libsane-utils.install} | 2 - debian/libsane-utils.manpages | 3 + debian/libsane1.README.Debian | 44 +++++------- debian/not-installed | 1 + debian/po/POTFILES.in | 2 +- debian/po/ca.po | 67 ++---------------- debian/po/cs.po | 62 ++--------------- debian/po/da.po | 64 ++---------------- debian/po/de.po | 68 ++----------------- debian/po/es.po | 69 ++----------------- debian/po/eu.po | 66 ++---------------- debian/po/fi.po | 66 ++---------------- debian/po/fr.po | 68 ++----------------- debian/po/gl.po | 79 ++-------------------- debian/po/it.po | 65 ++---------------- debian/po/ja.po | 65 ++---------------- debian/po/nl.po | 68 ++----------------- debian/po/pl.po | 65 ++---------------- debian/po/pt.po | 64 ++---------------- debian/po/pt_BR.po | 67 ++---------------- debian/po/ru.po | 64 ++---------------- debian/po/sk.po | 63 ++--------------- debian/po/sv.po | 64 ++---------------- debian/po/templates.pot | 51 ++------------ debian/po/vi.po | 65 ++---------------- debian/po/zh_CN.po | 61 ++--------------- debian/rules | 34 +++------- ...ils.README.Debian => sane-daemon.README.Debian} | 51 ++++++-------- debian/{sane-utils.config => sane-daemon.config} | 0 debian/{sane-utils.dirs => sane-daemon.dirs} | 0 debian/sane-daemon.install | 2 + debian/sane-daemon.links | 1 + ...{sane-utils.logrotate => sane-daemon.logrotate} | 0 debian/sane-daemon.manpages | 1 + .../{sane-utils.postinst => sane-daemon.postinst} | 14 ---- debian/{sane-utils.postrm => sane-daemon.postrm} | 1 - ...ils.saned.default => sane-daemon.saned.default} | 2 +- ...ane-utils.saned.init => sane-daemon.saned.init} | 1 - ...utils.saned.socket => sane-daemon.saned.socket} | 0 ...s.saned@.service => sane-daemon.saned@.service} | 0 debian/sane-daemon.templates | 15 ++++ debian/sane-utils.links | 2 - debian/sane-utils.maintscript | 1 + debian/sane-utils.manpages | 3 - debian/sane-utils.templates | 35 ---------- 47 files changed, 283 insertions(+), 1404 deletions(-) rename debian/{sane-utils.install => libsane-utils.install} (69%) create mode 100644 debian/libsane-utils.manpages rename debian/{sane-utils.README.Debian => sane-daemon.README.Debian} (51%) rename debian/{sane-utils.config => sane-daemon.config} (100%) rename debian/{sane-utils.dirs => sane-daemon.dirs} (100%) create mode 100644 debian/sane-daemon.install create mode 100644 debian/sane-daemon.links rename debian/{sane-utils.logrotate => sane-daemon.logrotate} (100%) create mode 100644 debian/sane-daemon.manpages rename debian/{sane-utils.postinst => sane-daemon.postinst} (86%) rename debian/{sane-utils.postrm => sane-daemon.postrm} (96%) rename debian/{sane-utils.saned.default => sane-daemon.saned.default} (51%) rename debian/{sane-utils.saned.init => sane-daemon.saned.init} (99%) rename debian/{sane-utils.saned.socket => sane-daemon.saned.socket} (100%) rename debian/{sane-utils.saned@.service => sane-daemon.saned@.service} (100%) create mode 100644 debian/sane-daemon.templates delete mode 100644 debian/sane-utils.links create mode 100644 debian/sane-utils.maintscript delete mode 100644 debian/sane-utils.manpages delete mode 100644 debian/sane-utils.templates
Jörg — a friendly reminder that this pull request is ready for review. (See the bottom of this message). Please refer to our earlier discussion below; I have added a comment. In the Securing Debian Manual, section 3.6 — "Install the minimum amount of software required" — explains this using the same reasoning. https://www.debian.org/doc/manuals/securing-debian-manual/ch03s06.en.html "Since you already know what the system is for (don't you?) you should only install software that is really needed for it to work. Any unnecessary tool that is installed might be used by a user that wants to compromise the system or by an external intruder that has gotten shell access (or remote code execution through an exploitable service)." Can you please review the pull request below? (See the "Merge workflow" described in gitworkflows(7): to apply these changes, you can simply run "git pull https://salsa.debian.org/dpward/sane-backends.git develop".) Thank you, David---------------------------------------------------------------- David Ward (6): Remove remaining support for RUN parameter in sysvinit service d/rules: Replace override_dh_installman-* with explicit file lists d/rules: Use override_dh_auto_install-arch for removing rpaths d/*.README.Debian: Fix references to the libsane1 package d/*.README.Debian: Adjust to reflect current permissions Split sane-utils package into sane-daemon and libsane-utils