[Bug 1878006] [NEW] [MIR] liburing

[Launchpad Bug Tracker]

You have been subscribed to a public bug by Christian Ehrhardt  (paelzer):

[Availability]
liburing is in universe in groovy at version 0.6-3 without Ubuntu Delta at the moment.
It builds for the Ubuntu architectures amd64, arm64, armhf, ppc64el, riscv64, s390x.

[Rationale]
liburing can be used for advanced asynchronous IO in qemu (>=5),
samba (>=4.12.x) and probably more down the road.
- https://lwn.net/Articles/776703/
- https://unixism.net/loti/
- https://github.com/axboe/liburing/

Since groovy is the first step towards 22.04 I think it would be great to
enable liburing now and see how things behave and if/how they are further
adopted.

[Security]

There was a CVE of the kernel side of the interface
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19241
It is already handled and fixed in all Ubuntu releases:
https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19241.html

So far nothing else came up, but generally I/O interfaces are a good place
to exploit so there is an elevated risk I guess.

[Quality assurance]

The package has build time tests that are not yet working, so it ignores the
return value for now, but runs them to gather data. Mostly it seems permission
or kernel config errors.

It also has autopkgtests but those also miss permissions.

Note: I have forwarded an MP to Debian about the root permission at
build/test time.

Further all seems ok:
- No debconf questions.
- No long-term outstanding bugs.
- The package is maintained well in Debian/Ubuntu (sync, no open bugs)
- The package does not deal with exotic hardware (just very recent kernels)
- The package uses a debian/watch file
- not using python(2)
- symbols tracking is in place
- lintian --pedantic is rather happy

[UI standards]

this has no end-user UI, so no translations seem needed.

[Dependencies]

No other dependencies than libc6. This really is just a path to the kernel
and does not need many other components.

[Standards compliance]
- The package meets the FHS and Debian Policy standards.
- d/rules and d/control as small and well written

[Maintenance]

The Server team will subscribe for the package for maintenance

[Background]
quote https://unixism.net/loti/
"""
io_uring is a powerful new way to do asynchronous I/O programming under Linux.
Doing away with various limitations of previous generation I/O subsystems,
io_uring holds immense promise. For more details on what io_uring brings to
the table, please see the chapter What is io_uring?.
"""

** Affects: liburing (Ubuntu)
     Importance: Undecided
         Status: In Progress


** Tags: security-review-done
-- 
[MIR] liburing
https://bugs.launchpad.net/bugs/1878006
You received this bug notification because you are a member of Ubuntu Package Archive Administrators, which is subscribed to the bug report.