Re: [gentoo-dev] Some suggestions

[Jan Krueger]

On Sunday 07 September 2003 17:39, Thomas de Grenier de Latour wrote:
> On Sun, 7 Sep 2003 19:07:03 +0000
>
> Jan Krueger <jk@×××××××××××.net> wrote:
> > The notable difference is:
> > /usr/sbin/foo is not executed automaticly while emerge.
>
> You lack imagination: the bash scripts used by emerge are just
> as easy to corrupt using a src_install only ebuild.

So this clearly is a bug that must be fixed.

> > On the other hand i try discuss on g-hardened how to detect malicious
> > code.
>
> Cryptographic signature as suggested by avenj would be a much more
> realistic approach here. Since I do my phd in the security-oriented
> program analysis domain, it breaks my heart to say that, but it's a
> fact.

but even cryptographic signatures got compromised (by faulty algorithms, users 
handling the keys unappropriate, ..., and even gentoo-core [supposed to 
handle the keys] is made out of humans and humans do make mistakes) So 
cryptographics signatures alone are not the holy grail as isnt 
security-oriented program analysis. But each one of them raises the bar a 
little bit, and both of them a little bit more :)

So does fixing the security holes in portage. We have identified 2 big ones so 
far:
1. functions like pkg_postinst
2. easy to compromise bash scripts
and another one is already well known:
3. the centralized portage tree

That leads me to the conclusions:
portage is unsecure by design

Please (the one responsible for it) clearify the statement:
"Thanks to a technology called Portage, Gentoo Linux can become an ideal 
secure server" in http://www.gentoo.org/main/en/about.xml

I have to remove gentoo from my servers a little bit faster it seems...

Jan


--
gentoo-dev@g.o mailing list