[HN Gopher] Finding people's use of /usr/bin/Python with the Lin...
___________________________________________________________________
Finding people's use of /usr/bin/Python with the Linux audit
framework
Author : ingve
Score : 16 points
Date : 2023-01-05 17:49 UTC (5 hours ago)
(HTM) web link (utcc.utoronto.ca)
(TXT) w3m dump (utcc.utoronto.ca)
| nyrikki wrote:
| Why not just use the alternatives(8) to create a wrapper script
| to log use?
| cesarb wrote:
| Because /usr/bin/python comes from the the python-is-python2
| package (or the python-is-python3 package), and it's a plain
| symlink, not something managed by update-alternatives. So the
| correct thing to use for a wrapper script would probably be
| dpkg-divert, instead of alternatives.
| nyrikki wrote:
| That is an advantage not a reason it can't be used.
|
| Yes alternatives(8) points a symbolic link to a name in the
| alternatives directory, which means that when you custom
| package's link to /user/bin/python is overwritten it is
| trivial to restore.
|
| A lot less fragile and resource intensive than using the
| audit system which the blog post clearly mentions is a bit
| crusty.
|
| Apparmor is another method that is a bit less expensive if it
| is in use but obviously doesn't work for containers.
| nyrikki wrote:
| To expand on the point, /usr still has to support the
| shared NFS mount model that has mostly been irrelevant for
| 20 years, the old perl alternatives was partially written
| to deal with that case.
|
| I am pretty sure python2-minimal still triggers update
| alternatives to support that shared filesystem model.
|
| Putting the named links in /etc allows for local
| configuration and keeps links DAGs
| cesarb wrote:
| > Yes alternatives(8) points a symbolic link to a name in
| the alternatives directory, which means that when you
| custom package's link to /user/bin/python is overwritten it
| is trivial to restore.
|
| If you use dpkg-divert, it won't be overwritten in the
| first place. If you install any package which contains a
| file or symbolic link with that name, that file will
| instead be written to the name you specified in your dpkg-
| divert command. It's the correct way (in Debian-derived
| distributions) to locally override a file or symbolic link
| which comes from a package which does not use the
| alternatives mechanism (which is the case for the python-
| is-python2 and python-is-python3 packages; AFAIK, they
| contain a plain symbolic link, instead of using update-
| alternatives).
| javierhonduco wrote:
| At my previous job, I wrote a simple bpftrace script [1] to track
| Python2 invocations. The output of this program was sent to a
| message bus and eventually stored in a columnar database for
| exploration.
|
| While Python2 got removed from the base operating system image,
| we wanted to uncover weird edge cases of engineers running
| special builds. We found more than one :)
|
| I think BPF is underused for safe deprecations. It's super useful
| to prove that an executable is not loaded, or that a method is
| not called while being traced :)
|
| [1]: https://github.com/javierhonduco/bpf-
| playground/blob/master/...
___________________________________________________________________
(page generated 2023-01-05 23:02 UTC)