[MIR] dracut

Review for Source Package: dracut

[Summary]
MIR team ACK under the complex constraints listed below.

This does need a security review, or not, well ....
It really depends on the scope - the current requested scope is just
'dracut-install' which would be fine if fully separated.

Otherwise (read if later anyone wants to use more of dracut) it would need
security review as outlined in the security section below.

List of specific binary packages to be promoted to main: (?dracut-install?)
Specific binary packages built, but NOT to be promoted to main: all others

Required TODOs:
#1 - I mentioned above this would need security review and much more if
     staying as-is.
     I'm really just looking for a good compromise for you, tell me if you
     strongly dislike this :-)
     And I'm afraid that even just functionally no one had time yet to deeply
     test all the potential interactions with the many Ubuntu packages this
     could interact and depends on.
     I wanted to ask you what you would think of breaking out
     /usr/lib/dracut/dracut-install into a 'dracut-install' binary package.
     Make it a depends from dracut-cure to not break the former use-case in
     universe.
     With that in place I think we could agree on promoting just dracut-install
     to main without the full security-review needed now.
     To use more of dracut you can then take your time in further cycles.

Update:
- bdrung and I talked, we will separate dracut-install to pass for now.
- but we will enqueue it into security-review as well as having a look
  at all the "later TODOs" plus evaluating dracut for Ubuntu in general.
- Overall that decouples the current urgent needs from the
  good-but-ok-to-happen-later elements

Recommended TODOs:
#2 - The package should get a team bug subscriber before being promoted

Later TODOs:
This MIR is a special case as I'm reviewing with urgency and a very reduced
use-case in mind. But passing along I've found a few things which should be
looked at once we'd wan't to use more of dracut.
Most of this is "recommended" todo, but should be looked at.

#3 - for now it makes the process and build easier to not use dracut-cpio
     but since this is done for speed (which here we really talk about two
     boot-time and initramfs update time) it might be worth to experiment and
     look at the difference that this might give us.
     https://github.com/dracutdevs/dracut/commit/51d21c6b37
     https://github.com/dracutdevs/dracut/commit/afe4a6dbb7
     This would be part of "we look at the whole thing" efforts as
     we can't be sure yet if it really helps our case.

#4 - Since this generally and especially once introduced for more use case
     than just dracut-install will surely hit some edge cases and break
     I think this might be a case to have a look at translations.

#5 - resolve netplan interaction in bug 2019940

#6 - please demote pigz to a suggests (or even better consider to add it to main
     as the rationale behind this is speed and this should make creation
     a bit faster as well)
     This is not needed for just dracut-install if split out.

[Duplication]
The only other package in main providing similar...

Back to bdrung for the agreed steps before being able to promote.

I just uploaded dracut 059-4ubuntu2 to split out dracut-install. I'll prepare the initramfs-tools change now.

This now correctly shows up as component mismatch.
What is missing to promote src:dracut and bin:dracut-install is the subscription of foundation-bugs to src:dracut

foundations-bugs is now subscribed to src:dracut

Thanks, this is now ready for the agreed reduced set

Override component to main
dracut 059-4ubuntu2 in mantic: universe/utils -> main
Override [y|N]? y
1 publication overridden.

Override component to main
dracut-install 059-4ubuntu2 in mantic amd64: universe/utils/optional/100% -> main
dracut-install 059-4ubuntu2 in mantic arm64: universe/utils/optional/100% -> main
dracut-install 059-4ubuntu2 in mantic armhf: universe/utils/optional/100% -> main
dracut-install 059-4ubuntu2 in mantic ppc64el: universe/utils/optional/100% -> main
dracut-install 059-4ubuntu2 in mantic riscv64: universe/utils/optional/100% -> main
dracut-install 059-4ubuntu2 in mantic s390x: universe/utils/optional/100% -> main
Override [y|N]? y
6 publications overridden.

With that done, it now enters the "second phase".
Which is "how about promoting more of src:dracut".
For that bdrung will work on the list of TODOs out of the MIR review and ping back once all of them would be ready for re-evaluation.
While at that, this can enter the security review queue (assigning to ubuntu-security).
Overall the state goes back to "new" for this.

How do we protect against / prevent "the wrong dracut packages" to be installed in a system? I could imagine someone seeing dracut on a system and then using it to build their initramfs (which I assume is an unsupported configuration).

If someone accidentally installs too many of the binary packages, what are the consequences of this action?

Is promoting one package likely to make this mistake more likely?

Thanks

Installing any of the dracut binary package except the dracut binary package is not doing much on their own. You can run dracut manually to generate an initrd, but the kernel hook from initramfs-tools is used generate the initrd on kernel upgrades.

Installing the dracut binary package on the other hand will provide a kernel hook but also remove initramfs-tools (since it declares a conflict on it). In that case the users would probably get a working inird, but they will get into the unsupported territory.

I reviewed dracut 059-4ubuntu2 as checked into mantic. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.

dracut is used to create an initramfs image by copying tools and files from
an installed system and combining it with the dracut framework, usually
found in /usr/lib/dracut/modules.d.

- CVE History
  - CVE-2010-4176(high) - Ubuntu package not-affected
  - CVE-2012-4453(low) - Ubuntu package not-affected
  - CVE-2015-0794(low) - Ubuntu package not-affected
  - CVE-2016-8637(medium) - Ubuntu package not-affected
- Build-Depends (from debian/control)
  - debhelper-compat (= 12), debhelper, asciidoc-base, xsltproc, docbook-xsl,
    docbook-xml, quilt, libkmod-dev, pkg-config, cpio, kmod, udev, kpartx,
    libkmod2, e2fsprogs
- pre/post inst/rm scripts
  - There are two scripts found
  a) postinst script: This script is designed to regenerate initramfs for
     all installed Linux kernel versions on a Debian-based system. It uses
     trigger mechanisms to do so, and it can be manually invoked as well.
     This kind of script is typically used to ensure that the initramfs is
     updated when new kernels are installed or updated on the system,
     ensuring a smooth boot process.
  b) postrm script: This script is designed to clean up log files
     associated with the "dracut" process when invoked with the "purge"
     argument. It removes log files matching the pattern /var/log/dracut.log
     and then exits with a success status. This type of script can be useful
     for maintenance tasks related to package management or log file
     management.
- init scripts
  - NA
- systemd units
  - dracut-core and dracut-network
    - `/usr/lib/dracut/modules.d/` dir contains various modules used by
      dracut during the initramfs generation process. Each subdirectory
      represents a module, and these modules can add specific functionality
      or configurations to the initramfs.
    - `/lib/systemd/system/` dir contains systemd service unit files. These
      service unit files are symlinked to specific services and targets
      related to dracut. They define how systemd manages dracut related
      services during the system boot process.
    - `/usr/lib/dracut/modules.d/*` directory appears to be a dracut module
      related to systemd integration
    - `module-setup.sh` files are shell scripts used by the dracut modules
      to configure and set up specific functionalities in the initramfs.
      The scripts likely define how the modules should behave during the
      initramfs generation process.
    - Overall, these files and directories are part of the integration of
      dracut and systemd, and they contribute to the generation and
      management of the initramfs during the system boot process. Each
      module and service has a specific role in ensuring that the initramfs
      is correctly configured and functions as needed during the boot
      sequence.
- dbus services
  - NA
- setuid binaries
  - NA
- binaries in PATH
  - -rwxr-xr-x root/root 98202 2023-08-22 20:04 ./usr/bin/dracut
    -rwxr-xr-x root/root 3693 2023-08-22 20:04 ./usr/bin/dracut-catimages
    -rwxr-xr-x root/ro...