| 1 |
Michel Wilson wrote: |
| 2 |
|
| 3 |
>On Thu, Mar 25, 2004 at 10:32:05AM -0600, Andrew Gaffney wrote: |
| 4 |
> |
| 5 |
> |
| 6 |
>> |
| 7 |
>>That's the problem with using tripwire on a Gentoo system. It's meant for a |
| 8 |
>>system that doesn't change, which obviously isn't Gentoo. What if someone |
| 9 |
>>compromises your system after your last run of tripwire (not the updater) |
| 10 |
>>and before when you emerge a package and update the database. The |
| 11 |
>>compromise would go unnoticed. |
| 12 |
>> |
| 13 |
>> |
| 14 |
>> |
| 15 |
>Good point. Well, then we should check the package before upgrading it, |
| 16 |
>or check each file before we overwrite it with a new file. The first is |
| 17 |
>probably the easiest, but then there might be a very theoretical chance |
| 18 |
>that a file is overwritten which didn't belong to the old version of the |
| 19 |
>package. I don't know if such a situation would ever happen, though. |
| 20 |
> |
| 21 |
> |
| 22 |
It should be possible to add a feature to emerge that updates installed |
| 23 |
packages MD5 to the tripwire database so the next time tripwire runs it |
| 24 |
doesn't report false positives. |
| 25 |
|
| 26 |
>Michel Wilson. |
| 27 |
> |
| 28 |
> |
| 29 |
|
| 30 |
|
| 31 |
-- |
| 32 |
Sandino Araico Sánchez |
| 33 |
-- Lo que no mata engorda. |
| 34 |
|
| 35 |
|
| 36 |
-- |
| 37 |
gentoo-security@g.o mailing list |
Archives