Challenges in Validating FLOSS Configuration

Raab, Markus; Barany, Gergö

doi:10.1007/978-3-319-57735-7_11

Cited by 7 publications

(5 citation statements)

References 27 publications

(25 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently, a few studies investigated automated techniques or engineering practices to enhance configuration checking code [16], diagnosability [104], interface [45], security [14], [105], [106], configuration data analysis [107], configuration libraries [108], [109], and correlations or coupling in configuration and code [110]- [112]. Our work corroborates and complements the aforementioned work from the perspective of software evolution.…”

Section: Related Worksupporting

confidence: 78%

An Evolutionary Study of Configuration Design and Implementation in Cloud Systems

Zhang¹,

He²,

Legunsen³

et al. 2021

Preprint

View full text Add to dashboard Cite

Many techniques were proposed for detecting software misconfigurations in cloud systems and for diagnosing unintended behavior caused by such misconfigurations. Detection and diagnosis are steps in the right direction: misconfigurations cause many costly failures and severe performance issues. But, we argue that continued focus on detection and diagnosis is symptomatic of a more serious problem: configuration design and implementation are not yet first-class software engineering endeavors in cloud systems. Little is known about how and why developers evolve configuration design and implementation, and the challenges that they face in doing so.This paper presents a source-code level study of the evolution of configuration design and implementation in cloud systems. Our goal is to understand the rationale and developer practices for revising initial configuration design/implementation decisions, especially in response to consequences of misconfigurations. To this end, we studied 1178 configuration-related commits from a 2.5 year version-control history of four large-scale, activelymaintained open-source cloud systems (HDFS, HBase, Spark, and Cassandra). We derive new insights into the software configuration engineering process. Our results motivate new techniques for proactively reducing misconfigurations by improving the configuration design and implementation process in cloud systems. We highlight a number of future research directions. This is a preprint of the work (with the same title) published at the 43rd International Conference on Software Engineering (ICSE'21). The content should be exactly the same as the conference proceeding version, except that the conference version does not have the replication package due to its page limit. The version is required by ICSE'21 because "accessibility become vital for such a big, distributed and virtual conference"-due to the global COVID-19 pandemic, ICSE'21 will be a virtual conference in zoomsphere.

show abstract

Section: Related Worksupporting

confidence: 78%

An Evolutionary Study of Configuration Design and Implementation in Cloud Systems

Zhang¹,

He²,

Legunsen³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Few studies cover field configurations of software systems (e.g., for deployment and orchestration). In fact, information of field configurations is highly desired, not only by operators and sysadmins to learn best practices, but also by developers and DevOps engineers to measure software usability and manageability [13,17,18,25,27,29].…”

Section: Introductionmentioning

confidence: 99%

Mining container image repositories for software configuration and beyond

Marinov

2018

Proceedings of the 40th International Conference on Software Engineering: New Ideas and Emerging Results

View full text Add to dashboard Cite

This paper introduces the idea of mining container image repositories for configuration and other deployment information of software systems. Unlike traditional software repositories (e.g., source code repositories and app stores), image repositories encapsulate the entire execution ecosystem for running target software, including its configurations, dependent libraries and components, and OS-level utilities, which contributes to a wealth of data and information. We showcase the opportunities based on concrete software engineering tasks that can benefit from mining image repositories. To facilitate future mining efforts, we summarize the challenges of analyzing image repositories and the approaches that can address these challenges. We hope that this paper will stimulate exciting research agenda of mining this emerging type of software repositories. CCS CONCEPTS• Software and its engineering → Software libraries and repositories; Software post-development issues; Software configuration management and version control systems;

show abstract

“…Raab et al [17][18][19] created the Elektra framework to validate the access to configuration values to detect misconfigurations as soon as possible. We tried to achieve the same with our a-priori verification process.…”

Section: Related Workmentioning

confidence: 99%

“…We tried to achieve the same with our a-priori verification process. In their study [19], they investigated how free/libre and open-source software (FLOSS) can be configured and the problem of validating configurations for it. One finding is that presently, P r e p r i n t configuration validation is encoded in a way unusable for external validation or introspection tools.…”

Section: Related Workmentioning

confidence: 99%

Automated implementation of windows-related security-configuration guides

Stöckle

Grobauer

Pretschner

2020

Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering

View full text Add to dashboard Cite

Hardening is the process of configuring IT systems to ensure the security of the systems' components and data they process or store. The complexity of contemporary IT infrastructures, however, renders manual security hardening and maintenance a daunting task.In many organizations, security-configuration guides expressed in the SCAP (Security Content Automation Protocol) are used as a basis for hardening, but these guides by themselves provide no means for automatically implementing the required configurations.In this paper, we propose an approach to automatically extract the relevant information from publicly available security-configuration guides for Windows operating systems using natural language processing. In a second step, the extracted information is verified using the information of available settings stored in the Windows Administrative Template files, in which the majority of Windows configuration settings is defined.We show that our implementation of this approach can extract and implement 83% of the rules without any manual effort and 96% with minimal manual effort. Furthermore, we conduct a study with 12 state-of-the-art guides consisting of 2014 rules with automatic checks and show that our tooling can implement at least 97% of them correctly. We have thus significantly reduced the effort of securing systems based on existing security-configuration guides. CCS CONCEPTS• Security and privacy → Software security engineering; Usability in security and privacy; • Software and its engineering → Software configuration management and version control systems.

show abstract

Challenges in Validating FLOSS Configuration

Cited by 7 publications

References 27 publications

An Evolutionary Study of Configuration Design and Implementation in Cloud Systems

An Evolutionary Study of Configuration Design and Implementation in Cloud Systems

Mining container image repositories for software configuration and beyond

Automated implementation of windows-related security-configuration guides

Contact Info

Product

Resources

About