Yaroslav Halchenko <
yarik...@gmail.com> writes:
> FWIW -- now singularity-container 2.1.2 package is also available from a
> stock Debian sid (AKA unstable), and thus likely might even become a
> candidate for upcoming stretch release.
Does the setuid code meet Debian's standards for a releasable package?
I don't think it's releasable for Fedora, and I still need to consult on
what to do about that.
For what it's worth, I recently found the useful-looking
<
https://research.cs.wisc.edu/mist/presentations/XSEDE2014-SecureProgramming.pdf>
from a reference to guidelines on writing secure code to which I assume
XSEDE applications are meant to adhere. Maybe something from XSEDE
carries weight. Several general points from it are addressed in the
changes under <
https://github.com/loveshack/singularity/tree/2.x>.
Others aren't, like more secure file opening, which would break test.sh.
Another thing hinted at in those guidelines: I prevented sexec building
with a non-GNU libc because it doesn't sanitize the environment, and I
couldn't see anything in musl, at least, doing the job. It may not be
an issue in practice, since I doubt such libraries are used on
multi-access systems, but better safe than sorry.