Gentoo Archives: gentoo-security

From: "Butterworth
To: "gentoo-security@l.g.o" <gentoo-security@l.g.o>
Subject: RE: [gentoo-security] portage/rsync question
Date: Wed, 07 Apr 2010 16:05:10
Message-Id: 8622C222D2FC9D499533B1EEF631D39303331FA8F8@IMCMBX1.MITRE.ORG
In Reply to: Re: [gentoo-security] portage/rsync question by Mansour Moufid
1 So to avoid "spamming" with 20+ Thank You emails I'll send out just one and thank you all collectively for the information provided (I hope this isn't rude - I'm not sure of proper protocol in this situation).
3 I have a lot more insight now and some new ideas of where I need to look to learn more. This is a great community and it reflects in the OS - I don't know why I waited so long to try Gentoo.(??)!
4 -john
6 -----Original Message-----
7 From: Mansour Moufid [mailto:mansourmoufid@×××××.com]
8 Sent: Tuesday, April 06, 2010 10:15 PM
9 To: gentoo-security@l.g.o
10 Subject: Re: [gentoo-security] portage/rsync question
12 On Tue, Apr 6, 2010 at 2:56 PM, Butterworth, John W.
13 <jbutterworth@×××××.org> wrote:
14 > If someone makes a change to a copy of a program (say a backdoor added to
15 > apache) hosted on a public mirror, will the sync’ing between the public
16 > mirror and the main rotation mirror determine that it's corrupted (via 'bad'
17 > checksum) on the public-mirror side and replace it?
19 Package files themselves aren't part of the Portage tree (i.e. they
20 aren't hosted by the Portage mirrors). Only the ebuilds (and
21 accompanying metadata files) are. Ebuilds (generally) will point to
22 the package files on public websites.
24 If an attacker has access to the package files (say at,
25 then your local Portage would indeed notice the corruption. On the
26 other hand, if they have access to the ebuilds and Manifest files of
27 the mirror you rsync to, Portage checks protect against nothing. At
28 that point, unless the attacker also controls the mirror server's
29 syncing with the main Gentoo tree, then yes, any malicious changes
30 would be overwritten during its next sync. That's not something to
31 count on.
33 --
34 Mansour Moufid


File name MIME type
smime.p7s application/x-pkcs7-signature