NixOS support

[06kellyjac]

I'm interested in having NixOS scanning support

λ trivy --debug rootfs ./result/
2022-02-03T12:36:37.127Z	DEBUG	Severities: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
2022-02-03T12:36:37.129Z	DEBUG	cache dir:  /home/jk/.cache/trivy
2022-02-03T12:36:37.129Z	DEBUG	DB update was skipped because DB is the latest
2022-02-03T12:36:37.129Z	DEBUG	DB Schema: 1, Type: 1, UpdatedAt: 2022-02-03 06:39:53.921368932 +0000 UTC, NextUpdate: 2022-02-03 12:39:53.921368432 +0000 UTC, DownloadedAt: 2022-02-03 12:36:34.753061274 +0000 UTC
2022-02-03T12:36:37.129Z	DEBUG	Vulnerability type:  [os library]
2022-02-03T12:36:37.134Z	DEBUG	OS is not detected and vulnerabilities in OS packages are not detected.
2022-02-03T12:36:37.134Z	DEBUG	Detected OS: unknown
2022-02-03T12:36:37.134Z	INFO	Number of language-specific files: 0

λ ls ./result/
activate
append-initrd-secrets
bin
configuration-name
dry-activate
etc
extra-dependencies
firmware
init
init-interface-version
initrd
kernel
kernel-modules
kernel-params
nixos-version
specialisation
sw
system
systemd

---

I was looking into adding the feature, basing my code off the existing code for alpine/amazon/rhel and diving into trivy-db but I realized all these distros have official vuln trackers.

I was hoping to just use NVD warnings but I noticed no other scanner explicitly relies on that & it also has the downside of being quite inaccurate since we do apply patches to fix some vulns.

One point on accuracy is it wouldn't be any more inaccurate than https://github.com/flyingcircusio/vulnix/ , which is currently the only nix/nixos CVE scanner I'm aware of, and only relies on NVD

It'd be nice to have another option, especially one written in golang. And I think it'd be good to get this out there ahead of an increase in nix use due to people becoming more interested in Supply Chain, Provenance, SBOM, Hermetic builds, Reproducible builds, SLSA, etc which are areas nix is quite nifty

One other thing I haven't looked into is if trivy follows symlinks. NixOS uses quite a lot of symlinks so this might end up being required. If following symlinks isn't existing behavior maybe it can be optional or only turned on for NixOS? etc

[github-actions]

This issue is stale because it has been labeled with inactivity.

[06kellyjac]

This is still important to me. As I said I'm happy to work on this but I need some guidance

[knqyf263]

Sorry we missed it. Doesn't it have security advisories?

[06kellyjac]

We just consume advisories from https://nvd.nist.gov & https://openwall.com AFAIK. We automatically put nvd posts into issues (e.g. NixOS/nixpkgs#166626) and vulnix (the tool linked above) also uses NVD

Other than that it's just discussion in matrix and sometimes listing them in our packaging:

https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/applications/graphics/autotrace/default.nix#L70-L123

but its quite non-standard atm so pulling those out with a script wouldn't be great right now

https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/applications/misc/adobe-reader/default.nix#L38-L41

Would it be possible to just use NVD as the source for now? Or would we need to maintain our own list?

[knqyf263]

it also has the downside of being quite inaccurate since we do apply patches to fix some vulns.

As you are aware, other distributions have backport fixes and fixed versions are different from NVD. If we use NVD, it will lead to a lot of false positives. We're concerned about it.

[06kellyjac]

Ok cool. I can have a chat with the NixOS team and see if people want to maintain a list :)
Thanks

[github-actions]

This issue is stale because it has been labeled with inactivity.

[06kellyjac]

Hello @knqyf263

I'm looking into building out a fixes list & the alpine structure looks pretty good

https://secdb.alpinelinux.org/v3.10/main.json

Is there a standard for these types of lists across alpine, debian, etc or are they all pretty different?

Do you have a "favorite" security fix list that I'd be best off reviewing?

[knqyf263]

OVAL is the most famous format among vendor advisories. Also, OSV is recently getting popular for language-specific packages. Either works for us.

[06kellyjac]

Thanks. I might be misunderstanding but having a quick read through OVAL looks like a format for recording vulnerabilities that exist rather than recording what have already been fixed like alpine's secdb?

e.g. I want to make it clear that CVE-XYZ has been patched for our copy of busybox v0.0.0 so CVE-XYZ should be skipped instead of matching

[knqyf263]

OVAL supports patched and unpatched vulnerabilities both. You can refer to Red Hat's feeds.
https://www.redhat.com/security/data/oval/

[06kellyjac]

OK, thanks. Ill have a read through