Security Team Weekly Summary, 2009-02-07

[Robbie Williamson]

= Jamie Strandboge =
Role: happy place

== Issue Tracking ==
 * bug triage
 * CVE triage

== Updates ==
 * python-xml update: analyze, patch, build, test publish USN-890-4
 * xmlrpc-c update: analyze, patch, build
 * dhcp3: analyze, patch, build, test publish USN-803-2
 * UST: add check to umt's compare-log to help catch things like the
   dhcp3 issue

== Technology Development ==
 * AppArmor
  * libvirt
    - merge 0.7.5 from Debian
    - fix LP: #513544 (libvirt 0.7.5 crashed on first virt-manager
      connection)
    - fix crash on restart if domain is using PCI devices
    - fix MAC_ADMIN being cleared when compiled with libcap-ng
      (LP: #517714)
  * firefox apparmor
    - more name changes issues
    - adjust packaging for for 9.04 and earlier
  * add apparmor-notify to trunk
  * apparmor-notify refinements
 * QRT: get test-libvirt.py working again and in a semi-sane way. Also
   incorporate the libvirt apparmor tests
 * UFW:
   * fix LP: #512131 (ufw logging off doesn't disable LIMIT logs)
   * fix LP: #488032 (ufw logs noisy services)
   * fix LP: #513387 ("after-logging" rules are not loaded by default")
   * fix iptables vs iptables-restore bug (occasional 'resource
     temporarily unavailable' iptables error in lucid and later
     (upstart too early)
   * release 0.29.2 and 0.29.3
   * prepare 0.23.3-1 for Debian
   * prepare 0.23.3-0ubuntu1 for Lucid
   * fix status output which contains multibyte characters
   * add some more raw reports
   * add --force option to enable (LP: #496267)
   * add reset command (LP: #436608)
   * add rsyslog example configuration
 * discuss LP: #507148 with mdeslaur, slangasek and bryceh ([lucid]
   desktop runs out of video memory on ATI Radeon Mobility 7500)
 * report no KMS/with compiz lockup on ATI Radeon Mobility 7500:
   LP: #513950
 * report no KMS/with compiz garbling on ATI Radeon Mobility 7500:
   LP: #513956
 * report no KMS and no compiz notify-osd blackbox on ATI Radeon
   Mobility 7500: LP: #513968

== Community ==
 * ubuntu-security meeting
 * ReleaseStatus meeting
 * wiki updates (FAQ for pockets and components)

== Archive ==
 * process NEW





= Kees Cook =
Weekly Role: community

== Updates ==
* tested and published kernel updates (USN-894-1)
 * patched, built, tested, published lintian update (USN-891-1)
 * patched, built, tested, published fuse update (USN-892-1)
 * tracking down kernel build failures with ogasawara.
 * verified that squirrelmail works from karmic-proposed.
 * security-fake-synced opensaml2 on jaunty.
* security-fake-synced phpgroupware on jaunty, karmic.

== Technology Development ==
 * cleaned up dovecot and fetchmail tests for soren.
 * sent (and got accepted) upstream kernel patch for /proc/kmsg
handling.
 * reviewed kernel CVE processes with kernel team

== Technology Integration ==
 * opened MIR for libbusiness-isbn-perl and friends for liburi-perl
 * renewed sync request for prelink

== Auditing ==
 * reviewed checkbox
 * reviewing GRsecurity patches

== Community ==
 * security team meeting
 * gave presentation on running bleeding-edge Ubuntu
 * tech board meeting




= Marc Deslauriers =
Weekly role: triage

== Issue Tracking ==
 * CVE triage
 * security bug triage

== Updates ==
 * Worked on mysql updates

== Technology development ==
 * Pushed new ssl certs to mysql test suite
 * Merged virt-manager and virtinst from Debian testing
 * Added D-Bus service file to gnome-screensaver, and modified
gnome-screensaver-command
   to spawn service if necessary.
 * Modified gnome-power-manager to ignore gnome-screensaver being
respawned
 * Modified indicator-session to ignore gnome-screensaver being
respawned
 * Prepared and sent patches upstream
 * Investigate removing setuid from mount.cifs

== Auditing ==
 * reviewed checkbox
 * reviewed apport root_command_output()

== Canonical ==
 * Security team weekly meeting
                                  



-- 
Robbie Williamson                                     robbie at ubuntu.com
Ubuntu                                         robbiew[irc.freenode.net]                               

"You can't be lucky all the time, but you can be smart everyday" 
 -Mos Def

"Arrogance is thinking you are better than everyone else, while
Confidence is knowing no one else is better than you." -Me ;)