diff options
author | Simon Ruderich <simon@ruderich.org> | 2012-03-06 02:29:25 +0100 |
---|---|---|
committer | Junichi Uekawa <dancer@netfort.gr.jp> | 2012-03-09 07:56:42 +0900 |
commit | 78747b5f1081e3afa1d5e0147c4efdbd833b7d14 (patch) | |
tree | fb415523fa99290671f48f192aabbf6bb0cab5d3 /pbuilderrc.5 | |
parent | 3531748071ead7740ab1492d6e422cd3f4fae951 (diff) | |
download | pbuilder-78747b5f1081e3afa1d5e0147c4efdbd833b7d14.tar pbuilder-78747b5f1081e3afa1d5e0147c4efdbd833b7d14.tar.gz |
Bug#579028: pbuilder: installs untrusted packages without asking
Package: pbuilder
Version: 0.206
Tags: patch
Followup-For: Bug #579028
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Dear Maintainer,
The attached patch changes the defaults to always enforce signed
repositories and aborts if an untrusted/manipulated package is
installed. It adds the new option --keyring (APTKEYRINGS) to add
additional keyrings, which are then used to verify the (local)
signed repositories. This way no untrusted packages can be
installed.
To still allow untrusted/unsigned repositories - they are a very
bad idea and allow remote attackers performing a MITM to take
over the system, including all built packages - the new option
- --allow-untrusted (ALLOWUNTRUSTED) was added.
I tested it with the official Debian repository, signed and
unsigned local repositories and it works fine for me. But I'm
only a "normal" pbuilder user, so I might have missed something.
Please test the patch.
I haven't tested it with cdebootstrap, but it should work as
well.
The old PBUILDERSATISFYDEPENDSOPT --check-key option was
deprecated and is no longer used (it emits a warning now) as
validation is the default now.
The patch also contains documentation updates for the new
options/variables and updates for the NEWS file describing the
necessary changes to continue using untrusted packages (but
please don't do that - especially as a Debian developer).
Please have a look and include the patch as soon as possible to
fix this security issue.
Regards,
Simon
- -- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages pbuilder depends on:
ii cdebootstrap 0.5.8+b1
ii coreutils 8.13-3
ii debconf [debconf-2.0] 1.5.41
ii debianutils 4.2.1
ii debootstrap 1.0.38
ii dpkg-dev 1.16.1.2
ii wget 1.13.4-2
Versions of packages pbuilder recommends:
pn devscripts 2.11.4
pn fakeroot 1.18.2-1
pn sudo <none>
Versions of packages pbuilder suggests:
pn cowdancer <none>
pn gdebi-core <none>
pn pbuilder-uml <none>
- -- debconf information excluded
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJPVWhvAAoJEJL+/bfkTDL5ivAP/iayE8NRQnyk2HW8R+NiRXU3
uavLilwwpmEZyuciu8GxMQIAhT9HYd/DlkhF9I+yBSd30TO3fl0xW7YV9SaIZ+bv
IPwnZbHri4KfeV9Zob/gd2jrT9A2QCoFRW0ny4XNCK3NvtWH5KuH+TG2Mq5CQqdN
j4VJ3+76oJcbQbU7AUYXfvKDAsEb7gX+VwTEFLS4GrPkni/FIQJ8HHJhlTscyuCD
gQANCoRFZHVSMaas3xqi9KYFKgVS4BZ5Z/9FZuLeY5kWBfcbnIhQloVOWTQZIMRI
PhnqP1g62XlPu71K3a/Y2RMAcy3Gs6sUbW4OianIr2iskCndejih/MCb+3LmBFCg
Ekxi/CcJGrc7a0pV57Qs8Iwkm1siRZZUxcp4xdD3mo9iayoOt4sfFyrvBCYryilQ
7JKpQc3iNoV3EQql6KBu5G+GmFFWHmokpLvVY27n8LgkV2YSb2wrgxqXPfxcYHj7
0j/y2MFw+HOX/d5YSESMLxn9aiZBi7CkMtlMemzqizxlNlL/+OOZiDsi4vdH8L/j
Y0c2i9efjNeooc0/B9wASu/Ck8SWV8wW1EcfTag0p9Rp0avy4hoQUmG+MtgQsV0l
MQuWWysyxeJFX4Z8ooau82L6sIGC0L073JH6Y/C7uTOz9gKt+e5tV3fnU+pkWpqH
oF3CcmlykKX4SYzhUI/e
=6EPj
-----END PGP SIGNATURE-----
>From cadc48fb599d436577a6efedc7f25e175652a3a1 Mon Sep 17 00:00:00 2001
Message-Id: <cadc48fb599d436577a6efedc7f25e175652a3a1.1330997290.git.simon@ruderich.org>
From: Simon Ruderich <simon@ruderich.org>
Date: Tue, 6 Mar 2012 02:00:48 +0100
Subject: [PATCH] Enforce valid signed repositories by default.
Diffstat (limited to 'pbuilderrc.5')
-rw-r--r-- | pbuilderrc.5 | 36 |
1 files changed, 27 insertions, 9 deletions
diff --git a/pbuilderrc.5 b/pbuilderrc.5 index 14fde73..40fc8bb 100644 --- a/pbuilderrc.5 +++ b/pbuilderrc.5 @@ -178,17 +178,25 @@ may also be used to reset the list of options. The default value is to build source and binary package. .TP -.BI "DEBOOTSTRAPOPTS=" "( '\-\-variant=buildd' )" +.BI "DEBOOTSTRAPOPTS=" "( '\-\-variant=buildd' '\-\-keyring' '/usr/share/keyrings/debian\-archive\-keyring.gpg' )" When this option is set to .B "\-\-variant=buildd" .B "pbuilder" will invoke .B "$DEBOOTSTRAP" -with "\-\-variant=buildd" +with +.B "\-\-variant=buildd" option, which results in debootstrap creating a minimal chroot for buildd instead of trying to create a minimal installation chroot. -.B "DEBOOTSTRAP" -is another directive in this file. +.B "\-\-keyring" +is used to specify a keyring for debootstrap. +.TP +.BI "APTKEYRINGS=" "()" +Additional keyrings to use for package verification with apt, not used for +debootstrap (use +.B "$DEBOOTSTRAPOPTS" +). Use this to add (local) signed repositories. By default the +debian-archive-keyring package inside the chroot is used. .TP .BI "DEBOOTSTRAP=" "debootstrap" Use this option to switch the implementation of @@ -329,15 +337,25 @@ used until 0.172. The default is now "aptitude". .TP -.BI "PBUILDERSATISFYDEPENDSOPT=" "('\-\-check\-key')" +.BI "PBUILDERSATISFYDEPENDSOPT=" "()" Array of flags to give to pbuilder\-satisfydepends. -Specifying \-\-check\-key here will try to verify key signatures. .TP -.BI "APTGETOPT=" "('\-\-force\-yes')" +.BI "ALLOWUNTRUSTED=" "no" +Allow untrusted (no key installed) and unsigned repositories. +.BI Warning: +Enabling this option may allow remote attackers to compromise the system. +Better use signed repositories and +.B "$APTKEYRINGS" +to add the key(s). + +.TP +.BI "APTGETOPT=" "()" Extra flags to give to apt\-get. -Default is \-\-force\-yes, which will skip key verification of packages -to be installed. Unset if you want to enable key verification. + +.TP +.BI "APTITUDEGETOPT=" "()" +Extra flags to give to aptitude. .TP .BI "REMOVEPACKAGES=" "lilo" |