Re: Lintian clean?
On Mon, May 04, 2009 at 01:12:30PM -0700, Russ Allbery wrote:
> Patrick Matthäi <pmatthaei@debian.org> writes:
> > Russ Allbery schrieb:
>
> >> Given that anyone can upload packages to mentors, this seems like a
> >> fairly worrisome security risk.
>
> > Why that? It may be implemented as the current Debian buildd network.
> > OpenSuSE is also providing such a buildd service for their users, but
> > yeah, we need more buildd servers for that (if the pkgs should be
> > realy build for every arch).
>
> Builds are conventionally done as root under sbuild, and you can break
> out of chroots when you're root, thus enabling an attacker to upload a
> package that compromises the security of the buildd.
Agreed. Since sbuild nowadays can use schroot for building, the root
access issue is mitigated somewhat since root is only used for installing
build-deps and such. But the other issues you mentioned are still
potentially hazardous. Previously you even had passwordless sudo access
from inside the chroot on some systems!
With the addition of copy-on-write chroots such as LVM snapshots and
(not released yet but nearly done) union filesystems, the attacker would
only have access to a transient filesystem which will be purged immediately
after the build. Longer term, I'm also looking at integrating KVM
(and I guess qemu) support which would provide a complete scratch system
to avoid such issues. But not all arches can support this, and the
attacker would still have user access to the build environment for the
duration of the build.
Regards,
Roger
--
.''`. Roger Leigh
: :' : Debian GNU/Linux http://people.debian.org/~rleigh/
`. `' Printing on GNU/Linux? http://gutenprint.sourceforge.net/
`- GPG Public Key: 0x25BFB848 Please GPG sign your mail.
Reply to: