Skip to content

Commit 097f5be

Browse files
kotakanbekotakanbe
committed
Detect processes affected by update using yum-ps (#482)
Detect processes affected by update using yum-ps
1 parent 446a9f7 commit 097f5be

File tree

5 files changed

+358
-64
lines changed

5 files changed

+358
-64
lines changed

‎README.ja.md

+23-9
Original file line numberDiff line numberDiff line change
@@ -150,9 +150,12 @@ Vulsは上に挙げた手動運用での課題を解決するツールであり
150150
- Fastスキャン
151151
- root権限必要なし
152152
- スキャン対象サーバの負荷ほぼなし
153-
- インターネットに接続していない環境でもスキャン可能 (RedHat, CentOS, OracleLinux, Ubuntu, Debian)
153+
- インターネットに接続していない環境でもスキャン可能 (RedHat, CentOS, OracleLinux, Ubuntu and Debian)
154154
- Deepスキャン
155+
- Root権限が必要
155156
- Changelogの差分を取得し、そこに書かれているCVE-IDを検知
157+
- Updateに影響のあるプロセスの情報を、アップデート前に取得可能 (RedHat, CentOS, OracleLinux and Amazon Linux)
158+
156159
- スキャン対象サーバに負荷がかかる場合がある
157160
- リモートスキャンとローカルスキャン
158161
- リモートスキャン
@@ -609,7 +612,8 @@ Vulsをスキャン対象サーバにデプロイする。Vulsはローカルホ
609612
| Raspbian |1st time: Slow <br> From 2nd time: Fast| Need | No | Need |
610613

611614

612-
- Ubuntu, Debian, Raspbian
615+
#### Changelog
616+
- Ubuntu, Debian and Raspbian
613617
`apt-get changelog`でアップデート対象のパッケージのチェンジログを取得し、含まれるCVE IDをパースする。
614618
アップデート対象のパッケージが沢山ある場合、チェンジログの取得に時間がかかるので、初回のスキャンは遅い。
615619
ただ、２回目以降はキャッシュしたchangelogを使うので速くなる。
@@ -620,6 +624,10 @@ Vulsをスキャン対象サーバにデプロイする。Vulsはローカルホ
620624
- Amazon, RHEL and FreeBSD
621625
`yum changelog`でアップデート対象のパッケージのチェンジログを取得する(パースはしない)。
622626

627+
#### Detect processes affected by update using yum-ps
628+
- RedHat, CentOS, OracleLinux and Amazon Linux
629+
次回のソフトウェアアップデートに影響のあるプロセスを事前に知ることができる。
630+
623631
----
624632

625633
# Use Cases
@@ -899,13 +907,13 @@ Deep Scan Modeでスキャンするためには、下記のパッケージが必
899907
| Distribution | Release | Requirements |
900908
|:-------------|-------------------:|:-------------|
901909
| Ubuntu | 12, 14, 16| - |
902-
| Debian | 7, 8, 9| aptitude, reboot-notifier |
903-
| CentOS | 6, 7| yum-plugin-changelog, yum-utils |
904-
| Amazon | All | yum-plugin-changelog, yum-utils |
910+
| Debian | 7, 8, 9| aptitude, reboot-notifier |
911+
| CentOS | 6, 7| yum-plugin-changelog, yum-utils, yum-plugin-ps |
912+
| Amazon | All | yum-plugin-changelog, yum-utils, yum-plugin-ps |
905913
| RHEL | 5 | yum-utils, yum-security, yum-changelog |
906-
| RHEL | 6, 7 | yum-utils, yum-plugin-changelog |
914+
| RHEL | 6, 7 | yum-utils, yum-plugin-changelog, yum-plugin-ps |
907915
| Oracle Linux | 5 | yum-utils, yum-security, yum-changelog |
908-
| Oracle Linux | 6, 7 | yum-utils, yum-plugin-changelog |
916+
| Oracle Linux | 6, 7 | yum-utils, yum-plugin-changelog, yum-plugin-ps |
909917
| FreeBSD | 10 | - |
910918
| Raspbian | Wheezy, Jessie | - |
911919
@@ -925,7 +933,13 @@ Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"
925933
926934
- RHEL 6, 7 / Oracle Linux 6, 7
927935
```
928-
vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --color=never repolist, /usr/bin/yum --color=never --security updateinfo list updates, /usr/bin/yum --color=never --security updateinfo updates, /usr/bin/repoquery
936+
vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --color=never repolist, /usr/bin/yum --color=never --security updateinfo list updates, /usr/bin/yum --color=never --security updateinfo updates, /usr/bin/repoquery, /usr/bin/yum --color=never -q ps all
937+
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"
938+
```
939+
940+
- Amazon Linux, CentOS
941+
```
942+
vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --color=never -q ps all
929943
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"
930944
```
931945
@@ -935,7 +949,7 @@ vuls ALL=(ALL) NOPASSWD: /usr/bin/apt-get update
935949
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"
936950
```
937951
938-
- CentOS, Amazon Linux, FreeBSDは今のところRoot権限なしでスキャン可能
952+
- FreeBSDは今のところRoot権限なしでスキャン可能
939953
940954
----
941955

‎README.md

+39-27
Original file line numberDiff line numberDiff line change
@@ -154,10 +154,11 @@ Vuls is a tool created to solve the problems listed above. It has the following
154154
- Fast scan and Deep scan
155155
- Fast Scan
156156
- Scan without root privilege
157-
- Scan with No internet access. (RedHat, CentOS, OracleLinux, Ubuntu, Debian)
157+
- Scan with No internet access. (RedHat, CentOS, OracleLinux, Ubuntu and Debian)
158158
- Almost no load on the scan target server
159159
- Deep Scan
160160
- Scan with root privilege
161+
- Detect processes affected by update using yum-ps (RedHat, CentOS, OracleLinux and Amazon Linux)
161162
- Parses the Changelog
162163
Changelog has a history of version changes. When a security issue is fixed, the relevant CVE ID is listed.
163164
By parsing the changelog and analysing the updates between the installed version of software on the server and the newest version of that software
@@ -587,35 +588,36 @@ On the aggregation server, you can refer to the scanning result of each scan tar
587588
- Scan without Root Privilege
588589
- Scan with No internet access on some OS.
589590

590-
| Distribution| Scan Speed | Need Root Privilege | OVAL | Need Internet Access <br>on scan tareget|
591-
|:------------|:--------------------------------------:|:-------------------:|:----------:|:---------------------------------------:|
592-
| CentOS | Fast |　 No | Supported | No |
593-
| RHEL | Fast |　 No | Supported | No |
594-
| Oracle | Fast |　 No | Supported | No |
595-
| Ubuntu | Fast |　 No | Supported | No |
596-
| Debian | Fast |　 No | Supported | No |
597-
| Raspbian |1st time: Slow <br> From 2nd time: Fast | Need | No | Need |
598-
| FreeBSD | Fast |　 No | No | Need |
599-
| Amazon | Fast |　 No | No | Need |
591+
| Distribution| Scan Speed | Need Root | OVAL | Need Internet Access <br>on scan tareget|
592+
|:------------|:--------------------------------------:|:---------:|:----------:|:---------------------------------------:|
593+
| CentOS | Fast | No | Supported | No |
594+
| RHEL | Fast | No | Supported | No |
595+
| Oracle | Fast | No | Supported | No |
596+
| Ubuntu | Fast | No | Supported | No |
597+
| Debian | Fast | No | Supported | No |
598+
| Raspbian |1st time: Slow <br> From 2nd time: Fast | Need | No | Need |
599+
| FreeBSD | Fast | No | No | Need |
600+
| Amazon | Fast | No | No | Need |
600601

601602

602603
---------
603604

604605
### Deep Scan
605606
![Vuls-Scan-Flow](img/vuls-scan-flow.png)
606607

607-
| Distribution| Scan Speed | Need Root Privilege | OVAL | Need Internet Access <br>on scan tareget|
608-
|:------------|:-------------------------------------:|:-------------------------:|:---------:|:---------------------------------------:|
609-
| CentOS | Slow |　 No | Supported | Need |
610-
| RHEL | Slow |　 Need | Supported | Need |
611-
| Oracle | Slow |　 Need | Supported | Need |
612-
| Ubuntu |1st time: Slow <br> From 2nd time: Fast| Need | Supported | Need |
613-
| Debian |1st time: Slow <br> From 2nd time: Fast| Need | Supported | Need |
614-
| Raspbian |1st time: Slow <br> From 2nd time: Fast| Need | No | Need |
615-
| FreeBSD | Fast |　 No | No | Need |
616-
| Amazon | Slow |　 No | No | Need |
608+
| Distribution| Scan Speed | Need Root | OVAL | Need Internet Access <br>on scan tareget|
609+
|:------------|:-------------------------------------:|:---------:|:---------:|:---------------------------------------:|
610+
| CentOS | Slow | No | Supported | Need |
611+
| RHEL | Slow | Need | Supported | Need |
612+
| Oracle | Slow | Need | Supported | Need |
613+
| Ubuntu |1st time: Slow <br> From 2nd time: Fast| Need | Supported | Need |
614+
| Debian |1st time: Slow <br> From 2nd time: Fast| Need | Supported | Need |
615+
| Raspbian |1st time: Slow <br> From 2nd time: Fast| Need | No | Need |
616+
| FreeBSD | Fast | No | No | Need |
617+
| Amazon | Slow | No | No | Need |
617618

618619

620+
#### Changelog
619621
- On Ubuntu, Debian and Raspbian
620622
Vuls issues `apt-get changelog` for each upgradable packages and parse the changelog.
621623
`apt-get changelog` is slow and resource usage is heavy when there are many updatable packages on target server.
@@ -627,6 +629,10 @@ Vuls issues `yum changelog` to get changelogs of upgradable packages at once and
627629
- On RHEL, Oracle, Amazon and FreeBSD
628630
Detect CVE IDs by using package manager.
629631

632+
#### Detect processes affected by update using yum-ps
633+
- RedHat, CentOS, OracleLinux and Amazon Linux
634+
It is possible to know processes affecting software update in advance.
635+
630636
----
631637

632638
# Use Cases
@@ -912,12 +918,12 @@ In order to scan with deep scan mode, the following dependencies are required, s
912918
|:-------------|-------------------:|:-------------|
913919
| Ubuntu | 12, 14, 16| - |
914920
| Debian | 7, 8, 9| aptitude, reboot-notifier |
915-
| CentOS | 6, 7| yum-plugin-changelog, yum-utils |
916-
| Amazon | All | yum-plugin-changelog, yum-utils |
921+
| CentOS | 6, 7| yum-plugin-changelog, yum-utils, yum-plugin-ps |
922+
| Amazon | All | yum-plugin-changelog, yum-utils, yum-plugin-ps |
917923
| RHEL | 5 | yum-utils, yum-security, yum-changelog |
918-
| RHEL | 6, 7 | yum-utils, yum-plugin-changelog |
924+
| RHEL | 6, 7 | yum-utils, yum-plugin-changelog, yum-plugin-ps |
919925
| Oracle Linux | 5 | yum-utils, yum-security, yum-changelog |
920-
| Oracle Linux | 6, 7 | yum-utils, yum-plugin-changelog |
926+
| Oracle Linux | 6, 7 | yum-utils, yum-plugin-changelog, yum-plugin-ps |
921927
| FreeBSD | 10 | - |
922928
| Raspbian | Wheezy, Jessie | - |
923929
@@ -937,7 +943,13 @@ Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"
937943
938944
- RHEL 6, 7 / Oracle Linux 6, 7
939945
```
940-
vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --color=never repolist, /usr/bin/yum --color=never --security updateinfo list updates, /usr/bin/yum --color=never --security updateinfo updates, /usr/bin/repoquery
946+
vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --color=never repolist, /usr/bin/yum --color=never --security updateinfo list updates, /usr/bin/yum --color=never --security updateinfo updates, /usr/bin/repoquery, /usr/bin/yum --color=never -q ps all
947+
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"
948+
```
949+
950+
- Amazon Linux, CentOS
951+
```
952+
vuls ALL=(ALL) NOPASSWD:/usr/bin/yum --color=never -q ps all
941953
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"
942954
```
943955
@@ -947,7 +959,7 @@ vuls ALL=(ALL) NOPASSWD: /usr/bin/apt-get update
947959
Defaults:vuls env_keep="http_proxy https_proxy HTTP_PROXY HTTPS_PROXY"
948960
```
949961
950-
- On CentOS, Amazon Linux, FreeBSD, it is possible to scan without root privilege for now.
962+
- On FreeBSD, it is possible to scan without root privilege for now.
951963
952964
----
953965

‎models/packages.go

+20-9
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ func (ps Packages) FormatUpdatablePacksSummary() string {
7171
return fmt.Sprintf("%d updatable packages", nUpdatable)
7272
}
7373

74-
// FindOne search a element by name-newver-newrel-arch
74+
// FindOne search a element
7575
func (ps Packages) FindOne(f func(Package) bool) (string, Package, bool) {
7676
for key, p := range ps {
7777
if f(p) {
@@ -83,14 +83,15 @@ func (ps Packages) FindOne(f func(Package) bool) (string, Package, bool) {
8383

8484
// Package has installed packages.
8585
type Package struct {
86-
Name string
87-
Version string
88-
Release string
89-
NewVersion string
90-
NewRelease string
91-
Arch string
92-
Repository string
93-
Changelog Changelog
86+
Name string
87+
Version string
88+
Release string
89+
NewVersion string
90+
NewRelease string
91+
Arch string
92+
Repository string
93+
Changelog Changelog
94+
AffectedProcs []AffectedProc `json:",omitempty"`
9495
}
9596

9697
// FormatVer returns package version-release
@@ -151,3 +152,13 @@ type Changelog struct {
151152
Contents string
152153
Method DetectionMethod
153154
}
155+
156+
// AffectedProc keep a processes information affected by software update
157+
type AffectedProc struct {
158+
PID string
159+
ProcName string
160+
CPU string
161+
RSS string
162+
State string
163+
Uptime string
164+
}

0 commit comments

Comments
 (0)