Re: [gentoo-security] tripwire policy generator

[Michel Wilson]

On Thu, Mar 25, 2004 at 10:32:05AM -0600, Andrew Gaffney wrote:
> Michel Wilson wrote:
> I tried to write a Perl script to do this, but I ran into problems. Of
> course, that was when I'd only been using Perl for 3 months. I'd probably
> be able to do it better now. One thing I was having problems with was
> binaries that had been prelinked. If you run prelink a certain way, it can
> give you the MD5SUM of the original binary, which is what portage does when
> unmerging a package. It didn't always work right for me, though. Maybe I'll
> try again.
Well, as you said, it is possible to get the original md5sum, so the
integrity-checker should be able to do this as well.
>
> >The major advantage of this integrated system would be that the integrity
> >information can be automatically updated if the user installs a new
> >package. Normally, with Tripwire, system maintenance is a nuisance. Every
> >time a new package is installed, Tripwire will generate false alarms.
> >Or, at least, when I used it it did, because I always forgot to update
> >the database...
>
> That's the problem with using tripwire on a Gentoo system. It's meant for a
> system that doesn't change, which obviously isn't Gentoo. What if someone
> compromises your system after your last run of tripwire (not the updater)
> and before when you emerge a package and update the database. The
> compromise would go unnoticed.
>
Good point. Well, then we should check the package before upgrading it,
or check each file before we overwrite it with a new file. The first is
probably the easiest, but then there might be a very theoretical chance
that a file is overwritten which didn't belong to the old version of the
package. I don't know if such a situation would ever happen, though.

Michel Wilson.