Incus maintainers can't check whether their 18 new flaws affect LXD, project leader says
Stéphane Graber says LXD's AGPLv3 license bars Incus maintainers from reading its code. Seven of the 18 advisories stayed Incus-only, mostly because LXD had separate reports.
By Emerson Redding · Published
Primary source: github.com
Why it matters
Incus maintainers can't look at LXD's code, so Incus's own disclosures can't show whether LXD users are exposed. Only Canonical can answer that, and it has confirmed just one shared flaw.
Incus maintainers can't check whether the 18 security flaws they disclosed on Oct. 30th also exist in Canonical's LXD, because LXD's license bars them from reading its code, Stéphane Graber, who leads the Linux Containers projects, including LXC, told RuntimeWire in an email.
"We don't know and we can't check," Graber said. LXD uses AGPLv3, while Incus uses Apache 2.0, and Incus developers "are not allowed to look at the LXD code due to the risk of being tainted by their license. So all we can do is notify the LXD team and let them take it from there."…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.