Capítulo 5. Problemas que debe tener en cuenta para stretch

Tabla de contenidos

5.1. Actualizar elementos específicos para Stretch
5.1.1. Late mounting of /usr is no longer supported
5.1.2. Noteworthy obsolete packages
5.1.3. Deprecated components for Stretch
5.1.4. Things to do post upgrade before rebooting
5.1.5. Executables are now compiled as position independent executables (PIE) by default
5.2. Limitaciones en el soporte de seguridad
5.2.1. Estado de seguridad en los navegadores web
5.2.2. Sin soporte de seguridad para el ecosistema construído alrededor de libv8 y Node.js
5.3. Package specific issues
5.3.1. Older ciphers and SSH1 protocol disabled in OpenSSH by default
5.3.2. Possible backwards incompatible changes to APT
5.3.3. The Xorg server is no longer setuid root by default
5.3.4. Upstart eliminado
5.3.5. The debhelper tool now generates dbgsym packages by default

Algunas veces los cambios tienen efectos colaterales que no podemos evitar, o aparecen fallos en otro lugar. A continuación se documentan los problemas que conocemos. Puede leer también la fe de erratas, la documentación de los paquetes relevantes, los informes de fallos, y otra información mencionada en Sección 6.1, “Para leer más”.

5.1. Actualizar elementos específicos para Stretch

Esta sección cubre los elementos relacionados con la actualización de Jessie a Stretch

5.1.1. Late mounting of /usr is no longer supported

[Nota]Nota

This section only applies to systems using a custom kernel, where /usr is on a separate mount point from /. If you use the kernel packages provided by Debian, you are unaffected by this issue.

Mounting of /usr using only tools found in / is no longer supported. This has only worked for a few specific configurations in the past, and now they are explicitly unsupported.

This means that for stretch all systems where /usr is a separate partition need to use an initramfs generator that will mount /usr. All initramfs generators in Stretch do so.

5.1.2. Noteworthy obsolete packages

The following is a list of known and noteworthy obsolete packages (see Sección 4.8, “Paquetes obsoletos” for a description).

The list of obsolete packages includes:

5.1.3. Deprecated components for Stretch

With the next release of Debian 10 (codenamed Buster) some features will be deprecated. Users will need to migrate to other alternatives to prevent trouble when updating to 10.

This includes the following features:

  • TODO: Add items if any

5.1.4. Things to do post upgrade before rebooting

When apt-get dist-upgrade has finished, the formal upgrade is complete, but there are some other things that should be taken care of before the next reboot.


      add list of items here
      
    

5.1.5. Executables are now compiled as position independent executables (PIE) by default

[Nota]Nota

This section mainly intended for developers or system administrators. Desktop users are unlikely to be affected by this section.

By default, the GNU GCC 6 compiler provided by Debian stretch will compile all executables as position independent. This provides a mitigation for an entire class of vulnerabilities, but it also leads to some changes that are worth being aware of.

  • The file tool (among other) will classify such binaries as "shared object" rather than an "executable". If you have filters based on binary files, these may need to be updated (e.g. spamfilters).

  • Static libraries being compiled into an executable now also need to be compiled as position independent code. The following error message from the linker is a symptom of this:

    relocation ... against '[SYMBOL]' can not be used when making a shared object; recompile with -fPIC
    

  • Historically, position independent executables have been associated with performance loss on some hardware. Notably the Debian architecture i386 (32-bit Intel machines). While GCC 5 and GCC 6 have greatly improved performance for position independent executables on 32-bit Intel, this optimisation may not be applicable to all architectures. Please consider evaluating the performance of your code if you are targetting machine architectures with very limited number of registers.

5.2. Limitaciones en el soporte de seguridad

Hay algunos paquetes para los que Debian no puede comprometerse a proporcionar versiones actualizadas resolviendo problemas de seguridad. La información de estos paquetes se cubre en las siguientes subsecciones.

Tenga en cuenta que el paquete debian-security-support ayuda a supervisar el estado de soporte de seguridad de los paquetes instalados en el sistema.

5.2.1. Estado de seguridad en los navegadores web

Debian 9 incluye varios motores de navegadores web que están afectados por un flujo constante de vulnerabilidades de seguridad. La alta tasa de vulnerabilidades y la falta de un soporte por parte de los desarrolladores a versiones anteriores hace muy difícil dar soporte a estos navegadores con arreglos de seguridad preparados para las versiones distribuidas. Además, las interdependencias entre bibliotecas hacen imposible actualizar a las nuevas versiones distribuidas. Por tanto, los navegadores basados en los motores de webkit, qtwebkit y khtml están incluidos en Stretch, pero no están cubiertos por el soporte completo de seguridad. No deberían utilizarse estos navegadores para acceder a sitios no confiables.

Para el uso general de navegación web recomendamos el uso de Firefox o Chromium.

Chromium, aunque basado en el código fuente de Webkit, es un paquete menor. Este paquete se mantendrá actualizado compilando las versiones actuales de Chromium para la versión «estable» de Debian. Firefox y Icedove también se mantendrán actualizadas recompilando la última versión de ESR para la versión «estable».

5.2.2. Sin soporte de seguridad para el ecosistema construído alrededor de libv8 y Node.js

La plataforma Node.js está construida sobre el paquete libv8-3.14, que ha tenido múltiples problemas de seguridad en el pasado. Actualmente no hay suficientes voluntarios dentro del proyecto o del equipo de seguridad interesados y dispuestos a dedicar el elevado tiempo necesario para resolver los problemas de seguridad que puedan aparecer en el futuro.

Esto significa que, desgraciadamente, que los paquetes libv8-3.14, nodejs, y el ecosistema de paquetes node-* no deberían utilizarse junto con contenido no confiable, como pueda ser datos no sanizados obtenidos de Internet.

Adicionalmente, no se va a proporcionar actualizaciones de seguridad para estos paquetes durante el ciclo de vida de Stretch.

5.3. Package specific issues

In most cases, packages should upgrade smoothly between Jessie and Stretch. There are a small number of cases where some intervention may be required, either before or during the upgrade; these are detailed below on a per-package basis.

5.3.1. Older ciphers and SSH1 protocol disabled in OpenSSH by default

The OpenSSH 7 release has disabled some older ciphers and the SSH1 protocol by default. Please be careful when upgrading machines, where you only have SSH access.

Please refer to the OpenSSH documentation for more information.

5.3.2. Possible backwards incompatible changes to APT

This section covers some of the incompatible changes to APT that may affect your system.

5.3.2.1. APT now fetches files with an unprivileged user ("_apt")

APT will now attempt to discard all root privileges before fetching files from mirrors. APT can detect some common cases where this will fail and fallback to fetching things as root with a warning. However, it may fail to detect some exotic setups (e.g. uid-specific firewall rules).

If you experience issues with this feature, please change to the "_apt" user and check that it:

  • has read access to files in /var/lib/apt/lists and /var/cache/apt/archives.

  • has read access to the APT trust store (/etc/apt/trusted.gpg and /etc/apt/trusted.gpg.d/)

  • can resolve DNS names and download files. Example methods for testing:

    # From the dnsutils package (if using tor, please check with tor-resolve instead).
    $ nslookup debian.org >/dev/null || echo "Cannot resolve debian.org"
    $ wget -q https://debian.org/ -O- > /dev/null || echo "Cannot download index page of debian.org"
    

    For DNS issues, please check that /etc/resolv.conf is readable.

5.3.2.2. Nuevos requisitos para los repositorios APT

[Nota]Nota

This section only applies if you have (or intend to use) third-party repositories enabled or if you maintain an APT repository.

To improve the download stability and ensure security of the downloaded content, APT now requires the following from an APT repository:

  • The InRelease file must be available

  • All metadata must include at least SHA256 checksums of all items. This includes the gpg signature of the InRelease file.

  • Signatures on the InRelease file should be done with a key at the size of 2048 bit or larger.

If you rely on a third-party repository that cannot comply with the above, please urge them to upgrade their repository. More information about the InRelease file can be found on the Debian Wiki.

5.3.3. The Xorg server is no longer setuid root by default

[Nota]Nota

This change only applies if your X Display Manager supports running X as rootless (or if you start X manually via startx). Currently the only known display manager supporting this is gdm. Other display managers simply start X as root regardless of this change.

This reduces the risk of privilege escalation via bugs in the X server. However, it has some requirements for working:

  • Necesita los paquetes logind y libpam-systemd.

  • It needs a kernel video driver (as Xorg cannot talk directly to the hardware anymore).

  • It needs to run on the virtual console it was started from.

When run as a regular user, the Xorg log will be available from ~/.local/share/xorg/.

If these requirements are not possible, please install the xserver-xorg-legacy package to reinstate the setuid Xorg.

5.3.4. Upstart eliminado

Due to the lack of upstream maintainers, the Upstart init system has been removed from Stretch. If your system relies on this package, you should note that it will not be updated during the lifetime of Debian 9, and starting from Debian 10 (Buster), upstart jobs could be removed from packages.

Please consider switching to a supported init system, like systemd or openrc.

5.3.5. The debhelper tool now generates dbgsym packages by default

[Nota]Nota

This section mainly intended for developers or organizations that build their own debian packages.

The debhelper tool suite will now generate "dbgsym" packages by default for ELF binaries. If you develop and package binaries, please check that your tooling supports these extra auto-generated packages.

If you use reprepro, you want to upgrade it to at least version 4.17.0. At the time of writing, the aptly does not support dbgsym packages.

Should your tooling be unable to cope with these gracefully, you can ask debhelper to disable this feature by adding "noautodbgsym" in the DEB_BUILD_OPTIONS variable of your build service. Please see the dh_strip manpage for more information