Re: server and client in one package -> security issue

[ludo@gnu.org (Ludovic Courtès)]

Hello,

Hartmut Goebel <h.goebel@crazy-compilers.com> skribis:

> Am 09.02.2017 um 23:50 schrieb Ludovic Courtès:
>> I think the only reason to separate things usually is size, not
>> “aesthetics.”  So I’d be in favor of keeping both in the same output if
>> there’s no size problem.
>
> Separating clients and servers is not an "aesthetic" thing. It's a
> matter of security.
>
> One basic rule for hardening systems is: "only install the required
> software". If we munge server and clients packages, this obeys this rule.
>
> In my day-business I'm a security consultant (CISSP, CSSLP  and ISO
> 27001 Lead Implementer). And from my point of view Guix already has a
> medium problem of acceptance since it munges development-files and
> run-time files into one package - as we do for all libraries. This
> already contradicts the above mentioned basic rule.
>
> Now if Guix starts munging server and client components into one
> package, this plain disqualifies GuixSD from any security sensitive
> system. [*]
>
> [*] OTOH it opens up chances for big business: selling "Secure GuixSD"
> to customers.

Heheh, good for you!  ;-)

Seriously though, all I’m saying is that, until now, the main (only?)
criterion that we had for multiple outputs was size:

  https://www.gnu.org/software/guix/manual/html_node/Packages-with-Multiple-Outputs.html
  https://www.gnu.org/software/guix/manual/html_node/Submitting-Patches.html (#5)

This patch was using a different criterion.

Now, back to the “only install the required software”, I wouldn’t go as
far as you do.  I generally agree with the rule, but I’m skeptical as to
what this buys you from a security perspective: users can always install
whatever they want by hand anyway, and do you have an idea as to how
much code they install via their browser?

murmurd becomes a problem security-wise when you actually run it and
expose it to the network.  But that’s true of any piece of software that
talks to the network, especially if it’s written in C/C++.

The real solution to that is not to make it harder to install this or
that piece of software IMO.  Rather it’s to make sure they only run when
really needed, and in isolated environments as much as possible, as per
the “principle of least authority” (POLA).

WDYT?

Ludo’.