Re: [gentoo-dev] Some suggestions

[Jan Krueger]

On Sunday 07 September 2003 16:45, Thomas de Grenier de Latour wrote:
> On Sun, 7 Sep 2003 18:21:19 +0000
>
> Jan Krueger <jk@×××××××××××.net> wrote:
> > put
> > rm -rf /
> > in pkg_postinst
> >
> > put
> > rm -rf /
> > in src_install
> >
> > See the difference?
>
> In any system package "foo", put in src_install():
> cat << EOF > ${D}/usr/sbin/foo
>  #!/bin/sh
>  rm -rf /
> EOF
>
> Not that better...

The notable difference is:
/usr/sbin/foo is not executed automaticly while emerge. Thats what i try to 
address here. It must explicitly be called by someone/something after emerge 
time. So my system is safe at emerge time, at least.

On the other hand i try discuss on g-hardened how to detect malicious code.

> I think if you don't trust ebuilds, then you should not use them, or at
> least read them before. The same apply to any distribution package.
>
> What is done in pkg_postinst is supposed to be good on every system.
For sure, Windows is supposed to be good on every system too.
However its deficencies make it from time to time a threat for the internet: 
code red, nimda to name just 2 of them.
I see the potential for gentoo to join windows on its way to bring the 
internet down. especially i see this potential within portage because the 
whole portage tree has one central source, the only one source that needs to 
be compromised and it spreads to thousands of machines within a couple of 
minutes. So: No, i see no reason why i should ebuilds expect to be 
trustworthy. And you know this already! Dont try to fool me!
look at Manifest and digest! They are there because you know portage, the 
central tree and ebuilds are a risk that must be taken care of!
So i just try to make you sensible for another aspect of this risk.

> If
> you find an ebuild in which it is not true, then report it as a bug
Please understand: The bug is in portage! (at least from my point of view)

Jan


--
gentoo-dev@g.o mailing list