Add deb and RPM repository config and documentation by s3krit · Pull Request #1676 · paritytech/polkadot

s3krit · 2020-09-02T12:49:09Z

This change adds some documentation to the README.md on how to install the latest version of Polkadot using our package repositories, and some additional config to Cargo.toml for building .deb and .rpm packages with cargo-deb and cargo-rpm
Internal documentation on how the repos are maintained can be found here.

kirushik

By the way, do we package systemd units for polkadot?
I think we probably should (at least eventually), and bonus points for setting the necessary security mechanisms up: running polkadot as a separate unprivileged user, setting up limited capabilities for the daemon, properly handling logs...

kirushik · 2020-09-02T15:51:29Z

README.md

+# Import the security@parity.io GPG key
+curl -fsSL 'https://keys.mailvelope.com/pks/lookup?op=get&search=security%40parity.io&options=mr&exact=on' | apt-key add -
+# Add the Parity repository and update the package index
+echo 'deb https://releases.parity.io/deb buster main' >> /etc/apt/sources.list.d/parity.list


Can we please suggest putting the key into /usr/share/keyrings/ and using the deb [signed-by=<path to key>] URL… format instead?
There's no real reason to add a system-level apt key for a non-system repo.
(Warning: the key should be dearmored for this to work)

s3krit · 2020-09-03T12:14:24Z

By the way, do we package systemd units for polkadot?
I think we probably should (at least eventually), and bonus points for setting the necessary security mechanisms up: running polkadot as a separate unprivileged user, setting up limited capabilities for the daemon, properly handling logs...

We don't yet no, but there's no reason not to. It would be nicer if we could configure the node with a config file rather than having to edit the systemd service file each time. There are two outstanding issues for this in the Substrate repo (below).

paritytech/substrate#6856
paritytech/substrate#5887

kirushik · 2020-09-03T17:36:59Z

@s3krit the common way to handle this with systemd is to put your options into a env variable in /etc/default/polkadot, something like this:

POLKADOT_CLI_ARGS="--database paritydb --wasm-execution Compiled"

Then load those ENV vars into your Systemd unit with

[Service]
EnvironmentFile=/etc/default/polkadot

and then maybe using variable expansion when composing a string for the Exec= entry in the systemd unit.

I've seen quite a lot of daemons doing so, including docker for example.

kirushik

This is awesome!
Like, I'm really-really happy we're finally doing this.

It's up to you if you're going to fix my two remaining comments, those are really tiny nits.

Side note: maybe let's see if there some additional features of systemd we can use to make this setup more secure by default?
I would suspect @ddorgan would have a lot of first-hand experience in running polkadot services in production, and @DemiMarie to know as much about capability filters and other Linux isolation tools as humanely possible.

README.md

kirushik · 2020-09-07T17:12:37Z

README.md

+gpg --recv-keys --keyserver hkps://keys.mailvelope.com FF0812D491B96798
+gpg --export security@parity.io > /usr/share/keyrings/parity.gpg
+# Add the Parity repository and update the package index
+echo 'deb [signed-by=/usr/share/keyrings/parity.gpg] https://releases.parity.io/deb buster main' > /etc/apt/sources.list.d/parity.list


It's a really tiny nit, but since we're using the same repo for both buster and focal, maybe let's use some more generic name here in the path? I can easily imagine myself changing the distro name here, and ending up with an incorrect repository URL.
It's not a big issue (trivial to both check and figure out, and is probably only affects a small fraction of potential users anyway) — but I thought I'd better leave it as a note.

DemiMarie

The Debian and Fedora package install directions have a security vulnerability, and there are places where additional documentation could be added. The systemd unit files should be locked down more as well; systemd-analyze security will help with that.

DemiMarie · 2020-09-07T18:01:27Z

README.md

+
+```
+# Import the security@parity.io GPG key
+gpg --recv-keys --keyserver hkps://keys.mailvelope.com FF0812D491B96798


This needs to be a full (40 hex character) fingerprint, to prevent preimage attacks. If keys.mailvelope.com is a pool, we should also point to an individual server, as GPG can’t receive keys from a pool if it cannot resolve DNS.

40-hex-character fingerprint = 👍

Could you clarify on your second point? Do you mean specifying the keyserver with a single IP address in case of DNS failure? If so, is that a better solution than not being able to receive keys in the event of DNS issues?

GPG does support using an HTTP proxy, but only for standalone keyservers. It cannot receive keys from a pool without DNS. This has caused problems for me in the past when installing software in QubesOS, since QubesOS TemplateVMs can only access the Internet via a proxy and have no ability to resolve DNS.

README.md

DemiMarie · 2020-09-07T18:17:37Z

scripts/packaging/deb-maintainer-scripts/postinst

+  if [ ! -e "$config_file" ]; then
+    echo 'POLKADOT_CLI_ARGS=""' > /etc/default/polkadot
+  fi


Suggested change

if [ ! -e "$config_file" ]; then

echo 'POLKADOT_CLI_ARGS=""' > /etc/default/polkadot

fi

This isn’t actually needed, as systemd will treat an unset environment variable as an empty string.

My intent was to populate the blank config file so that users can edit it as necessary without having to consult the README again to see what the name of the CLI arg environment variable was named.

Good point. That said, /etc/default/polkadot should be included in the package as a configuration file.

README.md

DemiMarie · 2020-09-07T18:20:03Z

.rpm/polkadot.spec

+%define __spec_install_post %{nil}
+%define __os_install_post %{_dbpath}/brp-compress


I have written my own RPM spec files and have never seen either of these lines, so I recommend adding a comment explaining what they do.

.gitignore

scripts/packaging/polkadot.service

DemiMarie

Looks good!

DemiMarie · 2020-09-08T19:16:36Z

scripts/packaging/polkadot.service

+ProtectKernelTunables=true
+ProtectSystem=strict
+RemoveIPC=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_PACKET


We should not need AF_PACKET. In this case, it is harmless, as it requires CAP_NET_RAW to use, but it is still good practice to avoid it.

README.md

Co-authored-by: Demi Marie Obenour <demiobenour@gmail.com>

…to mp-package-config

s3krit · 2020-09-10T14:47:14Z

Final nags fixed :) Should be good to merge once green. I'll also manually add some info to the next release notes regarding our shiny new package repos

DemiMarie

LGTM!

* master: Allow the watermark to always land on the relay parent (#1689) Limit the maximum size of a downward message (#1690) Add deb and RPM repository config and documentation (#1676) Collator protocol subsystem (#1659)

This additional config is based on the output of `systemd-analyze security polkadot.service`. We recently added [our own](https://github.com/paritytech/polkadot/blob/master/scripts/packaging/polkadot.service) polkadot.service file in the polkadot repo and spent a little time researching which sandboxing and namespacing options we could take advantage of. Discussion for that PR is [here](paritytech/polkadot#1676 (comment)).

s3krit and others added 2 commits September 1, 2020 16:28

Add cargo rpm and cargo deb sections to Cargo.toml

4365251

Add installation instructions to README.md

93921b1

s3krit added B0-silent Changes should not be mentioned in any release notes C1-low PR touches the given topic and has a low impact on builders. labels Sep 2, 2020

s3krit requested a review from kirushik September 2, 2020 12:49

s3krit self-assigned this Sep 2, 2020

github-actions bot added the A0-please_review Pull request needs code review. label Sep 2, 2020

kirushik reviewed Sep 2, 2020

View reviewed changes

add systemd service file for the deb package

30b83f0

s3krit added 2 commits September 4, 2020 19:38

add configuration via /etc/default/polkadot

969b3ce

add systemd service for rpm-based distros

b5622dc

s3krit force-pushed the mp-package-config branch from 63382ee to b5622dc Compare September 4, 2020 17:39

dont use system keyring for GPG key

0bd5a3d

s3krit requested a review from kirushik September 4, 2020 18:11

kirushik approved these changes Sep 7, 2020

View reviewed changes

DemiMarie reviewed Sep 7, 2020

View reviewed changes

s3krit added 2 commits September 8, 2020 20:17

Harden the systemd service file

27564b3

update README.md

f79387a

DemiMarie reviewed Sep 8, 2020

View reviewed changes

s3krit and others added 6 commits September 8, 2020 21:21

Add AF_UNIX to allowed sockets

4ac826d

Update README.md

743335d

Co-authored-by: Demi Marie Obenour <demiobenour@gmail.com>

rename buster repo to release

c80b46e

remove useless lines from rpm spec

fe65534

remove AF_PACKET from allowed address families

5d3639b

Merge branch 'mp-package-config' of github.com:paritytech/polkadot in…

d4d8ed7

…to mp-package-config

s3krit added the A8-mergeoncegreen label Sep 10, 2020

DemiMarie approved these changes Sep 10, 2020

View reviewed changes

s3krit merged commit d6ce4c0 into master Sep 10, 2020

s3krit deleted the mp-package-config branch September 10, 2020 15:22

wpank mentioned this pull request Sep 10, 2020

Document using Polkadot with package managers w3f/polkadot-wiki#934

Closed

s3krit mentioned this pull request Sep 16, 2020

Improve security of polkadot.service w3f/polkadot-validator-setup#99

Open

	if [ ! -e "$config_file" ]; then
	echo 'POLKADOT_CLI_ARGS=""' > /etc/default/polkadot
	fi

		%define __spec_install_post %{nil}
		%define __os_install_post %{_dbpath}/brp-compress

Comments

Conversation

s3krit commented Sep 2, 2020

Uh oh!

kirushik left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

s3krit commented Sep 3, 2020

Uh oh!

kirushik commented Sep 3, 2020

Uh oh!

kirushik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DemiMarie left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

DemiMarie left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

s3krit commented Sep 10, 2020

Uh oh!

DemiMarie left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants