| 1 |
On Mon, 4 Feb 2019 09:43:53 -0500 |
| 2 |
Rich Freeman <rich0@g.o> wrote: |
| 3 |
|
| 4 |
> On Mon, Feb 4, 2019 at 9:35 AM Alexis Ballier <aballier@g.o> |
| 5 |
> wrote: |
| 6 |
> > |
| 7 |
> > On Mon, 04 Feb 2019 15:13:36 +0100 |
| 8 |
> > Michał Górny <mgorny@g.o> wrote: |
| 9 |
> > |
| 10 |
> > > 2. By design, postinst is run with full privileges. It is meant |
| 11 |
> > > to allow ebuilds to run stuff, as root. |
| 12 |
> > |
| 13 |
> > And that is precisely that kind of design that makes it hard or |
| 14 |
> > unrealistic to have unreviewed global repositories. |
| 15 |
> > |
| 16 |
> |
| 17 |
> Unless you're doing something like per-app sandboxes at runtime fixing |
| 18 |
> this is just shifting the problem elsewhere. |
| 19 |
> |
| 20 |
> Ok, so the package can't run stuff at root at time of install. But, |
| 21 |
> it can drop whatever shell script it wants into /etc/cron.hourly, or |
| 22 |
> enable some service by default. Or it can stick something in the |
| 23 |
> default shell profile. Or it can install /sbin/bash which is ahead of |
| 24 |
> /bin/bash in PATH, or whatever. |
| 25 |
> |
| 26 |
> If malware is recognized as a legitimate package by your package |
| 27 |
> manager, you've basically already lost, at least in the typical |
| 28 |
> linux/unix-like access control model. Now, if you're doing |
| 29 |
> unconventional things like android does with uids or putting 3 layers |
| 30 |
> of SELinux on top of everything then you can have more defense in |
| 31 |
> depth. But, that also requires sandboxing your package manager so |
| 32 |
> that it can't tamper with ALL of your security. |
| 33 |
> |
| 34 |
> As mgorny has already pointed out, you can't just sandbox package |
| 35 |
> phases to fix the problem. I think sandboxing your build system is a |
| 36 |
> great way to improve build system QA in general, but it doesn't solve |
| 37 |
> intrusion. |
| 38 |
> |
| 39 |
|
| 40 |
|
| 41 |
Ok, so the claim here is that installing is more or less the same as |
| 42 |
running wrt malicious code. Fine. |
| 43 |
|
| 44 |
Now, I want to install an ebuild from that overlay: I review said |
| 45 |
ebuild, seems fine, so I add & enable the overlay. Except, someone just |
| 46 |
pushed a malicious app-shells/bash running malicious code at global |
| 47 |
scope. Last I checked portage will source it and in the best case |
| 48 |
output a warning about running commands at global scope. I am now pwned. |
Archives