So...I've transitioned jetty to systemd in F17. However during the transition I made a terribly stupid thing: enabled the service by default, which really was an accident (#831280).
This only happens on systems which had jetty installed on F16 and updated to F17. Since jetty is eclipse dependency a lot of development machines will have this as well.
Now, I've prepared a patch (attached) that should fix the issue. There is however one part of it which I'd like to ask opinions about:
+# bug 831280, needs to stay here until F19 +# users should enable jetty themselves. It was enabled accidentaly +%triggerun -- jetty < 8.1.2-9 +/bin/systemctl --no-reload disable jetty.service >/dev/null 2>&1 ||: +/bin/systemctl --no-reload stop jetty.service >/dev/null 2>&1 ||:
This trigger will do following: If we are updating from previous releases, we disable the service and stop it if it's running
The first line of the trigger is not very controversial I'd say. If the user hasn't enabled the service, it should be disabled by default. We have no way to know if the user wanted this enabled, or not. He might have even had it enabled in F16 and we disable this for him. Not an ideal solution, however leaving it be would result in having potentionally insecure web server running by default on a lot of machines.
The second line...well not sure here. Since I don't want to wait for users to restart their machine to get it secure again, I'd prefer to stop the service.
There would obviously be a description in the update which would explain the situation, but I doubt most users read it. I'd rather they realized their jetty is not running and having to enable to it manually than (or search for a solution). If we just told users to disable the service manually I worry a lot of them would not realize this.
So...+-?
On 06/14/2012 02:59 PM, Stanislav Ochotnicky wrote:
+%triggerun -- jetty < 8.1.2-9
You already have one triggerun for jetty in the spec: %triggerun -- jetty < 8.1.0-3
You're likely to hit this RPM bug: https://bugzilla.redhat.com/show_bug.cgi?id=702378
+/bin/systemctl --no-reload disable jetty.service >/dev/null 2>&1 ||: +/bin/systemctl --no-reload stop jetty.service >/dev/null 2>&1 ||:
This trigger will do following: If we are updating from previous releases, we disable the service and stop it if it's running
I dislike this, because: - You'd just break some users' systems for the sake of a different subset of users. - Some breakage during distribution upgrade is more tolerable than breakage within regular updates.
Is a running jetty really _that_ dangerous? Why do we ship it at all then? ;-)
Michal
Quoting Michal Schmidt (2012-06-14 15:10:56)
On 06/14/2012 02:59 PM, Stanislav Ochotnicky wrote:
+%triggerun -- jetty < 8.1.2-9
You already have one triggerun for jetty in the spec: %triggerun -- jetty < 8.1.0-3
You're likely to hit this RPM bug: https://bugzilla.redhat.com/show_bug.cgi?id=702378
I guess this in itself solves the problem for us. We can't fix user systems properly ergo...
+/bin/systemctl --no-reload disable jetty.service >/dev/null 2>&1 ||: +/bin/systemctl --no-reload stop jetty.service >/dev/null 2>&1 ||:
This trigger will do following: If we are updating from previous releases, we disable the service and stop it if it's running
I dislike this, because:
- You'd just break some users' systems for the sake of a different subset of users.
- Some breakage during distribution upgrade is more tolerable than breakage within regular updates.
Well not anymore, I'll just describe it in the bodhi update.
Is a running jetty really _that_ dangerous? Why do we ship it at all then? ;-)
Why do we ship Apache, tomcat and tens (hundrets?) of other useful packages? Jetty unlike most packages _is_ remotely accessible so the attack surface is rather large.
If you wrote that in a jest, then sorry but I don't take my mistake that could compromise security of Fedora's users that lightly.
Bummer...
On 06/14/2012 04:19 PM, Stanislav Ochotnicky wrote:
Quoting Michal Schmidt (2012-06-14 15:10:56)
Is a running jetty really _that_ dangerous? Why do we ship it at all then? ;-)
Why do we ship Apache, tomcat and tens (hundrets?) of other useful packages? Jetty unlike most packages _is_ remotely accessible so the attack surface is rather large.
If you wrote that in a jest, then sorry but I don't take my mistake that could compromise security of Fedora's users that lightly.
I thought the winking smiley gave it away.
But there is a basis for my jesting comment: It's great that you take security seriously, but I believe you're over-estimating the danger of the running service. Fedora has a firewall enabled by default. And I trust that the service receives any applicable security updates. The users' systems are not compromised.
Michal