Re: [gentoo-security] No, apparently not.

[Ed Grimm]

On Sun, 7 Nov 2004, Brian Bilbrey wrote:

> Peter Simons wrote:
> > So if you guys would like to be the laughing stock of the
> > free software community once this vulnerability is exploited
> > for the first time, all I say is: Be my guest.
>
> How is this NOT a problem with every distribution that offers downloads
> ... oh, that's right ... ALL of them? Yep.

Based on some comments I've read from others in this discussion, not
Debian.  I suspect there may be others, but, quite frankly, I'm not
following many distributions right now.

> Instead of a bunch of hounds baying at the Gentoo devs, who do what they
>  do without much in the way of remuneration, and who have absolutely the
> best intentions and concern for the user base ... why not HELP them
> design a tool that can help ameliorate the risk to some acceptable level.
>
> I'll agree that having signed files will be a step forward in security,
> but also ack that in the larger scheme of things, it means little. But
> progress in a forward direction is always a good thing. Now, how about
> an independent signature/hash of the entire portage tree?

RSYNC_EXCLUDEFROM.

A signature on the entire portage is only useful if people download the
entire portage.  Further, since you're having this performed by the
server, if one compromised that server, they could compromise all Gentoo
systems.  Finally, it means that one can only apply changes to the
master rsync server once an hour, and it takes up a fairly large amount
of resources when that happens.

Admittedly, that's assuming that the Gentoo baselayout maintainers have
resonably secure system - after all, no matter what, compromising a
baselayout maintainer's system, or to a lesser extent, any core herd
member's system, gives access to the whole pie.  But there isn't
anything that can be done about that, other than making certain that
they're educated on security practices and follow them.


So how is it that having the Manifest files all signed, and having the
Manifest signatures checked, and checking all the MD5 sums in the
Manifest files against the files in the directories only a partial
answer?  What openings remain for illicit content to make its way onto
the servers, without having gone through a dev?

Ed

--
gentoo-security@g.o mailing list