How to deploy CVE service via Snap¶

This guide assumes the livepatch-server snap has already been set up.

The Canonical Livepatch CVE service runs a simple HTTP server that periodically fetches and serves information about CVEs fixed in Ubuntu kernels. This guide covers setting up the CVE service snap and pointing the Livepatch Server snap to the service.

Install the CVE service snap¶

To install the latest stable CVE service snap from the Snap Store, run:

sudo snap install canonical-livepatch-cve-service

The HTTP service automatically initializes and begins listening on localhost:8090 with the default parameters. The service also begins downloading CVE data from the default OSV source on startup. The CVE service supports both .zip and .tar files for OSV sources.

To change the port and other parameters, see the configuration section.

Configure the snap¶

The CVE service snap has several configuration options available. All configuration options are set with:

sudo snap set canonical-livepatch-cve-service <config>=<value>

To restore a default value after a custom value has been used, set the config value to an empty string "":

sudo snap set canonical-livepatch-cve-service port=""

The service automatically restarts on a configuration change, ensuring that the service runs with the latest configuration.

The default upstream OSV source is about 400MB. The CVE service uses eTags to check if the source has changed, and only downloads from the source if there is new CVE data.

Configuration options¶

The following table lists all configuration options, their descriptions, examples, and default values.

Config option	Description	Example	Notes
`source`	URL or file path to fixed CVE information.	`"https://osv-vulnerabilities.storage.googleapis.com/Ubuntu/all.zip, https://security-metadata.canonical.com/osv/osv-all.tar.xz"`	When setting this option, the `source-type` config option must also be set. The default value is `"https://osv-vulnerabilities.storage.googleapis.com/Ubuntu/all.zip"`. When using a file path as the source, the file must be placed in `/var/snap/canonical-livepatch-cve-service/common`.
`source-type`	The format of the data source.	`"osv-bucket-zip"`	When setting this option, the `source` config option must also be set. The default value is `"osv-bucket-zip"`.
`fetch-freq`	When to fetch fixed CVE data. If set to `""`, the CVE service fetches data based on the interval configuration. If set to `once`, the CVE service fetches the data a single time at startup. If set to `never`, the CVE service does not fetch data from the source.	`"", "once", "never"`	When setting the option to `once` or `never`, the `interval` config option is ignored. When setting the option to `never`, the `source`, `source-type`, and `interval` options are ignored. The default value is `""`.
`interval`	The interval between CVE data fetches, in the format of `xxhxxmxxs`.	`"1h0m0s"`	The default value is `"1h0m0s"`. The CVE service enforces a minimum of 30 minute intervals. If the provided option is less than 30 minutes, the CVE service uses a 30 minute interval.
`port`	The port to bind to and listen for requests on.	`"8090"`	The default value is `"8090"`.
`write-timeout`	The write timeout for sending CVE data.	`"5m"`	The default value is `"5m"`.
`read-timeout`	The read timeout for reading from the Livepatch Server.	`"30s"`	The default value is `"30s"`.

Point the Livepatch Server to the CVE service¶

When connected to the CVE service, the Livepatch Server serves fixed CVE information and periodically refreshes its CVE cache by fetching from the CVE service. By default, the Livepatch Server has these features disabled so configuration values can be supplied based on a certain deployment.

To point the Livepatch Server to the CVE service:

Enable the CVE lookup feature:

sudo snap set canonical-livepatch-server lp.cve-lookup.enabled="true"

Enable the CVE sync feature and set the source URL to point to the CVE service:

sudo snap set canonical-livepatch-server lp.cve-sync.enabled="true"
sudo snap set canonical-livepatch-server lp.cve-sync.source-url="http://<host>:port"

Optionally, set the refresh interval and proxy information:

sudo snap set canonical-livepatch-server lp.cve-sync.interval="1h"
sudo snap set canonical-livepatch-server lp.cve-sync.proxy.enabled="true"
sudo snap set canonical-livepatch-server lp.cve-sync.proxy.http="<url>"
sudo snap set canonical-livepatch-server lp.cve-sync.proxy.https="<url>"
sudo snap set canonical-livepatch-server lp.cve-sync.proxy.no-proxy="<url>"

By default, the refresh interval is one hour and the proxy is disabled.

When the Livepatch Server receives fixed CVE data from the CVE service, it also receives a digest computed by the CVE service. Upon requesting CVE data, the server provides the CVE service with the digest. If the digest has not changed on the CVE service, the request is rejected with a “Not Modified” HTTP code, preventing the server from repeatedly downloading the same data.

Next steps¶

The Livepatch Server snap is now integrated with the CVE service snap, allowing client machines to receive fixed CVE information about their installed patches.