1 |
On Mon, Feb 4, 2019 at 9:35 AM Alexis Ballier <aballier@g.o> wrote: |
2 |
> |
3 |
> On Mon, 04 Feb 2019 15:13:36 +0100 |
4 |
> Michał Górny <mgorny@g.o> wrote: |
5 |
> |
6 |
> > 2. By design, postinst is run with full privileges. It is meant to |
7 |
> > allow ebuilds to run stuff, as root. |
8 |
> |
9 |
> And that is precisely that kind of design that makes it hard or |
10 |
> unrealistic to have unreviewed global repositories. |
11 |
> |
12 |
|
13 |
Unless you're doing something like per-app sandboxes at runtime fixing |
14 |
this is just shifting the problem elsewhere. |
15 |
|
16 |
Ok, so the package can't run stuff at root at time of install. But, |
17 |
it can drop whatever shell script it wants into /etc/cron.hourly, or |
18 |
enable some service by default. Or it can stick something in the |
19 |
default shell profile. Or it can install /sbin/bash which is ahead of |
20 |
/bin/bash in PATH, or whatever. |
21 |
|
22 |
If malware is recognized as a legitimate package by your package |
23 |
manager, you've basically already lost, at least in the typical |
24 |
linux/unix-like access control model. Now, if you're doing |
25 |
unconventional things like android does with uids or putting 3 layers |
26 |
of SELinux on top of everything then you can have more defense in |
27 |
depth. But, that also requires sandboxing your package manager so |
28 |
that it can't tamper with ALL of your security. |
29 |
|
30 |
As mgorny has already pointed out, you can't just sandbox package |
31 |
phases to fix the problem. I think sandboxing your build system is a |
32 |
great way to improve build system QA in general, but it doesn't solve |
33 |
intrusion. |
34 |
|
35 |
-- |
36 |
Rich |