Analysing installation scenarios of Debian packages

Benedikt Becker (1) , Nicolas Jeannerod (2) , Claude Marché (1) , Yann Régis-Gianas (2) , Mihaela Sighireanu (2) , Ralf Treinen (2)

1 TOCCATA - Formally Verified Programs, Certified Tools and Numerical Computations
2 IRIF (UMR_8243) - Institut de Recherche en Informatique Fondamentale

The Debian distribution includes 28 814 maintainer scripts, almost all of which are written in Posix shell. These scripts are executed with root privileges at installation, update, and removal of a package, which make them critical for system maintenance. While Debian policy provides guidance for package maintainers producing the scripts, few tools exist to check the compliance of a script to it. We report on the application of a formal verification approach based on symbolic execution to find violations of some non-trivial properties required by Debian policy in maintainer scripts. We present our methodology and give an overview of our toolchain. We obtained promising results: our toolchain is effective in analysing a large set of Debian maintainer scripts and it pointed out over 150 policy violations that lead to reports on the Debian Bug Tracking system.

Mots clés: Debian; Safety Properties; Quality Assurance; Software Package Installation; Shell Scripts; High-Level View of File Hierarchies; Symbolic Execution; Feature Tree Constraints

Domaines: Logique en informatique [cs.LO]; Langage de programmation [cs.PL]; Systèmes et contrôle [cs.SY]

Benedikt Becker, Nicolas Jeannerod, Claude Marché, Yann Régis-Gianas, Mihaela Sighireanu, et al.. Analysing installation scenarios of Debian packages. 2019. ⟨hal-02355602v1⟩