[gentoo-security] tripwire-ish portage scanner

[Andrew Gaffney]

I've come up with a quick n' dirty Perl script to use portage's MD5s in a tripwire fashion.

<code>
#!/usr/bin/perl

use strict;
use warnings;

my @files;

sub get_portage_info() {
   opendir CAT, "/var/db/pkg";
   foreach my $category (readdir CAT) {
     next if($category =~ /^\./);
     opendir PKG, "/var/db/pkg/${category}";
     foreach my $package (readdir PKG) {
       next if($package =~ /^\./);
       open CONTENTS, "/var/db/pkg/${category}/${package}/CONTENTS" or next;
       while(<CONTENTS>) {
         if(/^obj (.+) (\w+) (\d+)$/) {
           push @files, {file => "$1", pkg => "${category}/${package}", md5 => "$2", mtime 
=> "$3"};
         }
       }
       close CONTENTS;
     }
     closedir PKG;
   }
   closedir CAT;
}

sub check_md5($$) {
   my ($file, $portagemd5) = @_;
   my $currentmd5 = `md5sum "$file"`;
   $currentmd5 =~ s/^(\w+) .+$/$1/;
   chomp $currentmd5;

   return ($currentmd5 eq $portagemd5);
}

# Actual program starts here

get_portage_info();

foreach (@files) {
   if(!check_md5($_->{file}, $_->{md5})) {
     print "WARNING! file '$_->{file}' in $_->{pkg} has MD5 mismatch\n";
   }
}
</code>

It doesn't have support for checking prelinked binaries yet, but the system I ran it on 
isn't prelinked, I believe. The results for my system can be seen at 
<http://www.skylineaero.com/stuff/md5scan.log>. A lot of the Perl stuff is from 
overlapping packages, non-default configs for stuff in /etc, but I don't know why there 
are so many MD5 mismatches for all the Python stuff. Anyone have any idea?

-- 
Andrew Gaffney
Network Administrator
Skyline Aeronautics, LLC.
636-357-1548


--
gentoo-security@g.o mailing list