arch linux support

[r3k2]

Environment

arch linux
Wondering if there is documentation in how to add support for other popular linux distributions like Arch.

[kotakanbe]

@chrisfernandez

No documents, sorry.

I think FreeBSD's implementation is simple and helpful.
https://github.com/future-architect/vuls/blob/master/scan/freebsd.go

Basically, Add a detection logic here,
https://github.com/future-architect/vuls/blob/master/scan/serverapi.go#L74

And then implement the each interface.
https://github.com/future-architect/vuls/blob/master/scan/serverapi.go#L36
see https://github.com/future-architect/vuls/blob/master/scan/freebsd.go

[r3k2]

@kotakanbe Thanks I will take a look and will let you know if I hit any wall.
thanks <3

[r3k2]

@kotakanbe ok I got it to the point is detecting it, -debug flag helped a lot :) as of now is very very similar to the BSD one.. so next step I guess is to add arch and linux specific cve vulns etc?

 blackarch ~ ]$ vuls configtest 
[Oct 27 02:12:33]  INFO [localhost] Validating config...
[Oct 27 02:12:33]  INFO [localhost] Detecting Server/Container OS... 
[Oct 27 02:12:33]  INFO [localhost] Detecting OS of servers... 
[Oct 27 02:12:33]  INFO [localhost] (1/3) Detected: localhost: archlinux BlackArch Linux Live ISO
[Oct 27 02:12:37]  INFO [localhost] (2/3) Detected: matrix: ubuntu 16.10
[Oct 27 02:12:39]  INFO [localhost] (3/3) Detected: chat: ubuntu 16.04
[Oct 27 02:12:39]  INFO [localhost] Detecting OS of containers... 
[Oct 27 02:12:39]  INFO [localhost] Checking dependencies...
[Oct 27 02:12:39]  INFO [chat] Dependencies... No need
[Oct 27 02:12:39]  INFO [matrix] Dependencies... No need
[Oct 27 02:12:39]  INFO [localhost] Dependencies... No need
[Oct 27 02:12:39]  INFO [localhost] Checking sudo settings...
[Oct 27 02:12:39]  INFO [localhost] sudo ... No need
[Oct 27 02:12:39]  INFO [chat] sudo ... No need
[Oct 27 02:12:39]  INFO [matrix] sudo ... No need
[Oct 27 02:12:39]  INFO [localhost] Scannable servers are below...

if you can give me a small example like you did I will work on it after the weekend
and maybe have a pull request by end of next week.

PS: if you want to check what I done so far.:
https://github.com/ChrisFernandez/vuls
Cheers

[r3k2]

@kotakanbe sorry to msg again but I will have time tonight to work on tis after work will be nice to have a small tip/example on the CVE's part and what to add.. example some CVE's are not distro but linux kernel base or app base like apache so not sure how you guys do this overlaps etc. Thanks!

[kotakanbe]

memo: https://security.archlinux.org/

[r3k2]

@kotakanbe with Arch linux since there is no oval for it, like as bsd I am using a in-house tool arch-audit just like bsd uses something similar that outputs the CVE and package, but after running my scan says:

[Oct 31 17:58:17]  INFO [localhost] Validating config...                                                                                                          
[Oct 31 17:58:17]  INFO [localhost] cve-dictionary: /home/rek2/cve.sqlite3                                                                                        
[Oct 31 17:58:17]  INFO [localhost] Loaded: /home/rek2/results/2017-10-31T01:16:08-07:00                                                                          
[Oct 31 17:58:17]  INFO [localhost] Fill CVE detailed information with OVAL                                                                                       
[Oct 31 17:58:17] ERROR [localhost] Failed to fill OVAL information: OVAL for archlinux is not implemented yet 

Any suggestion? so far I got everything ported and working with no errors.. now I am not sure I am passing the output of arch-audit the right way I will take a look to that tonight.

here is an example of the output or arch-audit

[ blackarch ~ ]$ arch-audit --format "%n %c"
binutils CVE-2017-15996,CVE-2017-15025,CVE-2017-15024,CVE-2017-15023,CVE-2017-15022,CVE-2017-15021,CVE-2017-15020,CVE-2017-9044,CVE-2017-9043,CVE-2017-9042,CVE-2017-9041,CVE-2017-9040,CVE-2017-9039,CVE-2017-9038,CVE-2017-7210,CVE-2017-7209,CVE-2017-6969,CVE-2017-6966,CVE-2017-6965
cairo CVE-2017-7475
crypto++ CVE-2017-9434
exiv2 CVE-2017-11592,CVE-2017-11591,CVE-2017-11553
ffmpeg2.8 CVE-2017-14223,CVE-2017-14222
glibc CVE-2017-15671,CVE-2017-15670
go CVE-2017-1000098
jasper CVE-2017-9782,CVE-2017-6852,CVE-2017-6850,CVE-2017-5505,CVE-2017-5504,CVE-2017-5503
lame CVE-2017-9872,CVE-2017-9871,CVE-2017-9870,CVE-2017-9869,CVE-2015-9101
lib32-glibc CVE-2017-15671,CVE-2017-15670
libextractor CVE-2017-15922
libffi CVE-2017-1000376
libvorbis CVE-2017-11735,CVE-2017-11333
libzip CVE-2017-12858
linux CVE-2017-9986,CVE-2017-9985,CVE-2017-9984,CVE-2017-14954,CVE-2017-1000379,CVE-2017-1000371,CVE-2017-1000370,CVE-2017-1000365
mupdf CVE-2017-15587
openjpeg2 CVE-2016-9118,CVE-2016-9117,CVE-2016-9116,CVE-2016-9115,CVE-2016-9114,CVE-2016-9113
pcre CVE-2017-11164
zziplib CVE-2017-5980,CVE-2017-5978,CVE-2017-5977

hmm well since I am at it.. here is the current output of the scan

[ blackarch ~ ]$ vuls scan localhost
[Oct 31 18:03:08]  INFO [localhost] Start scanning
[Oct 31 18:03:08]  INFO [localhost] config: /home/rek2/config.toml
[Oct 31 18:03:08]  INFO [localhost] Validating config...
[Oct 31 18:03:08]  INFO [localhost] Detecting Server/Container OS... 
[Oct 31 18:03:08]  INFO [localhost] Detecting OS of servers... 
[Oct 31 18:03:08]  INFO [localhost] (1/1) Detected: localhost: archlinux BlackArch Linux
[Oct 31 18:03:08]  INFO [localhost] Detecting OS of containers... 
[Oct 31 18:03:08]  INFO [localhost] Detecting Platforms... 
[Oct 31 18:03:20]  INFO [localhost] (1/1) localhost is running on other
[Oct 31 18:03:20]  INFO [localhost] Scanning vulnerabilities... 
[Oct 31 18:03:20]  INFO [localhost] Scanning vulnerable OS packages...


One Line Summary
================
localhost       archlinuxBlackArch Linux        0 updatable packages




To view the detail, vuls tui is useful.
To send a report, run vuls report -h.

[kotakanbe]

https://github.com/ilpianista/arch-audit
cool! I did not know this.

[Oct 31 17:58:17] ERROR [localhost] Failed to fill OVAL information: OVAL for archlinux is not implemented yet 

• Amazon , BSD also have no oval.
  add archlinux to the switch case condition.
  https://github.com/future-architect/vuls/blob/master/report/report.go#L184

[r3k2]

@kotakanbe @ALL hey thanks for the info. I am still working on this, I got busy with work this last week and 1/2
but will catch up soon, don't forget abou this :D

[r3k2]

was showing the project to a friend, and wanted to update, I started a new job in December, about to install Vuln on our Ubuntu/Centos servers so this will be great oportunity for me to also add the arch support.. I left it almost done :( but will prob start from 0 and do it fresh.

[kotakanbe]

@ReK2Fernandez Cool!

[kotakanbe]

If you still want this, please re-open the issue.

[r3k2]

Hello @kotakanbe yes we will need this, since we have 5 arch linux servers and most developers run blackarch and other arch variants. we all moved to gitlab so do not check github almost, and saw this two issues you closed because I logged into my spam email at gmail