[Bug 1691557] Re: [MIR] opal-prd

[Emily Ratliff]

The Security Team acks this unreviewed. We reserve the right to perform
a security review at a later date. We are operating under the
assumptions that 1) IBM will try to provide backported security fixes
(per comment #3), 2) Server/Foundations teams will perform testing of
the security updates (per email discussion); 3)the opal-prd package is
built only for the ppc64el architecture; 4) opal-prd operates on trusted
input provided by the Power firmware.

** Changed in: skiboot (Ubuntu)
     Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to skiboot in Ubuntu.
Matching subscriptions: foundations-bugs-skiboot
https://bugs.launchpad.net/bugs/1691557

Title:
  [MIR] opal-prd

Status in skiboot package in Ubuntu:
  Incomplete

Bug description:
  [ Availability ]
  opal-prd has been in universe since xenial

  [ Rationale ]
  IBM is requesting opal-prd be installed by hw-detect on OpenPower systems to provide "acpid-like" functionality on OpenPower systems.

  [ Security ]
  I can find no CVEs relating to skiboot or opal-prd, which could mean it's perfect, but probably means it's just not been abused thoroughly by anyone yet.  Given a root daemon is involved, it could probably use a quick once-over.

  [ Quality ]
  skiboot is maintained in Debian by Frederic Bonnard, an IBM employee, has 0 open bugs in Debian, and 0 open bugs in Ubuntu.

  opal-prd installs a single daemon, asks no debconf questions, has
  systemd support, and comes configured correctly out of the box.

  [ Dependencies ]
  opal-prd has no dependencies outside main.

  [ Maintenance ]
  skiboot uses dh(1) style packaging, is lintian-clean, and the packaging is pretty clear and simple.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/skiboot/+bug/1691557/+subscriptions