Ubuntu
memcached package

[MIR] memcached

Bug #586634 reported by Clint Byrum
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
memcached (Ubuntu)
Fix Released
Wishlist
Unassigned
Ubuntu maverick-alpha-2

Bug Description

Binary package hint: memcached

Availability:

package has been in universe a long time.

Rationale:

Memcached is nearly ubiquitous in distributed web application design today. Its design is simple and its record for stability is incredibly high. We've included having it in main as one of our improvements for support of "Web 2.0" stacks in Maverick:

https://blueprints.launchpad.net/ubuntu/+spec/server-maverick-uds-web20-workloads

Security:

* There are no open security issues at this time, and all previous issues have been resolved quickly upstream.
* The rate of security issues has been fairly low, given the amount of exposure memcached has had, this is a good measure of the code quality.
* While in the past there was no way to protect memcached other than firewall, they have recently added optional SASL authentication to allow it to be run on a public network safely.

Quality assurance:

 * bugs
   * There are no open important debian or ubuntu bugs.

* test suite does not currently run, bug opened:
   * https://bugs.launchpad.net/ubuntu/+source/memcached/+bug/586632

UI standards:

N/A

Dependencies:

All dependencies are in main:

Depends: libc6 (>= 2.4), libevent-1.4-2 (>= 1.4.13-stable), perl, lsb-base (>= 3.2-13)

Standards compliance:

Package appears to be in full compliance with required standards.

Maintenance:

This is a very simple package and will not require complex maintenance.

Background information:

N/A

Related branches

lp:~clint-fewbar/ubuntu-seeds/add-memcached-and-libmemcached
Mathias Gug: Approve
Ubuntu Server: Pending requested
Diff: 22 lines (+5/-0)
1 file modified
supported-misc-servers (+5/-0)
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Also note that there is an open request to sync this package with debian unstable, which is the only version with the optional SASL authentication.

https://bugs.launchpad.net/ubuntu/+source/memcached/+bug/586613

Revision history for this message
Alexander Sack (asac) wrote :

seems to be directly exposed to network; feels like a good thing for kees to review.

Given that it previously was not protected other than through firewall, we should check that the package default configuration is safe now, imho; but Kees' call.

Changed in memcached (Ubuntu):
assignee: nobody → Kees Cook (kees)
Revision history for this message
Kees Cook (kees) wrote :

Since Debian 383660 is fixed, I'm less concerned about the firewall issues, but it is a network daemon, so it needs to be checked out a bit.

This daemon runs as "nobody", which isn't actually considered safe. The idea is that "nobody" should have no ownerships or access to anything. For example, running multiple daemons as "nobody" rather defeats the purpose. Before this is approved, I would like to see memcached running as a separate system user that is created/removed in the maintainer scripts. Debian 391351 almost did this, but it went from root to nobody. An improvement, for sure, but I'd like to see it done fully correct before it is in main.

Nothing else immediately jumps out at me, though. It seems to be reasonably defensive about incoming data. It's had problems in the past, but as seen, they're fixed quickly, easy to test, etc.

Changed in memcached (Ubuntu):
status: New → Incomplete
assignee: Kees Cook (kees) → nobody
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

I'm preparing a patch now to have memcached run as its own user.

Changed in memcached (Ubuntu):
status: Incomplete → In Progress
assignee: nobody → Clint Byrum (clint-fewbar)
Clint Byrum (clint-fewbar)
Changed in memcached (Ubuntu):
status: In Progress → Confirmed
assignee: Clint Byrum (clint-fewbar) → nobody
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Ok, I created this bug:

https://bugs.launchpad.net/ubuntu/+source/memcached/+bug/599461

Which has memcached running as the user/group 'memcache'.

Clint Byrum (clint-fewbar)
Changed in memcached (Ubuntu):
milestone: none → maverick-alpha-2
Revision history for this message
Kees Cook (kees) wrote :

This looks good. Thanks! +1 for main.

Changed in memcached (Ubuntu):
status: Confirmed → In Progress
Clint Byrum (clint-fewbar)
Changed in memcached (Ubuntu):
status: In Progress → Fix Released
importance: Undecided → Wishlist
Revision history for this message
Matthias Klose (doko) wrote :

now promoted

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.