Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In a blog post in response to the Amazon privacy controversy, Mark Shuttleworth wrote:
Don’t trust us? Erm, we have root. You do trust us with your data already. You trust us not to screw up on your machine with every update. You trust Debian, and you trust a large swathe of the open source community. And most importantly, you trust us to address it when, being human, we err.
What does he mean by "we have root"? Surely Canonical doesn't have root access to every machine running Ubuntu?
The wording of that sentence may seem a bit worrying because in a way it implies that they have root access as a backdoor that is already installed and in use. The truth is that it was just bad wording from Mark and what he tried to explain is that, yes, they have potential root access to your machine because every package update runs as root and at that point they can do and install anything they want or anything that could potentially sneak in from some open source project.
If you also go through the comments on that blog post you will find Mark giving the answer to your question(his username in comments is 'mark')
Someone asked him:
Sebastian says: (http://www.markshuttleworth.com/archives/1182#comment-396204)
September 23rd, 2012 at 11:42 am
Ermm. You have root? Details please.
and then Mark replied:
mark says: (http://www.markshuttleworth.com/archives/1182#comment-396225)
September 23rd, 2012 at 1:00 pm
@Sebastian – Every package update installs as root.
move to mv. They're always a bit terse.
You trust them because they distribute the software that runs your computer. Their processes run as root: you have to trust them because the computer is in their hands, more so than it is in yours. While you are the administrator of the machine, you use their tools to do your administrator tasks.
The point he's making is that you can only run an OS distributed by a vendor that you trust perfectly and completely, because the vendor has unlimited power with respect to the computers the OS runs on.
In this case, he's pointing out the apparent absurdity of cries that Canonical is invading the privacy of its users through Amazon integration. If the company wanted to invade your privacy, they could do so in much subtler and devious ways. But, he aruges, you do trust Canonical; you have from the beginning if you run Ubuntu on your computer as demonstrated by the fact that you run Ubuntu on your computer. So if you already trust them to do everything right, then you should trust them to do this right.
It's not a perfect arugment, and I'm not sure it's even a valid argument. But that's his argument.
Basically, every disto has it's own repository servers, which are the default option for the installed system to fetch packages from. This means that when you install a new package or download updates these are downloaded from those repositories.
You (we) trust the repo maintainers that the packages they upload are not malicious. Most of the official repositories offer the sources to the available packages, so you could theoretically download the sources see what it does and compile it yourself. But nobody does that.
Some time ago most package repositories implemented a package signing feature. Each package uploader has a personal signing key with which he signs his packages before he uploads them to the repo. That stops a malicious attacker (who has broken into the repository server) from serving his altered packages. It does not affect the actions of the uploader though, who could if he wanted serve a modified package.
The way the package management in most distos work is for a package to be installed system-wide it has to be installed with root privileges. Each package has hooks that must be run before and after installation for it's correct setup, and these too run with root privileges.
So you could, again theoretically, update you system, download a malicious package without even knowing it.
The point that Shuttleworth was trying to make is that if they, as Canonical, wanted to run something malicious on our systems they already have a way.
Ubuntu's installer and package manager run as root. They have to: that's the only way it can install an operating system. It also installs programs that run as root. Other Linux distributions (and other operating systems, for that matter) are no different, even though the exact particulars may change a little: Ubuntu just happens to be in scope for this discussion. There is basically no way around this, because part of the point of having a root account is so that nobody else can do these things, but somebody has to be able to do them.
Because of this, it would be trivial for the maker of an operating system to slip in a backdoor, and odds are, you would never even notice. For practical purposes, there is no way around this. You could get kind of close if you built your system yourself using Linux From Scratch, but this requires building your system yourself, and everything that entails (and actually, the LFS method requires you to do this twice). This is not something most people have the time, money, or expertise to do, and even if they did, it is still not a foolproof method of addressing this concern. The end result is that you have basically no choice but to trust the maker of your operating system.
The corollary to this is that you need to make sure that the maker of your operating system is someone you can trust. This part is where Shuttleworth's argument doesn't hold up so well. His stance reads far more like a confrontational "you have to trust us anyway so you should just deal with this" instead of an attempt to actually address, or even acknowledge, people's concerns.
Whenever you run sudo apt-get upgrade you're downloading a .deb package from the Ubuntu repositories and letting the installer run under root (you know, sudo) to install it. If Ubuntu wanted to manipulate one of the packages and include a backdoor, they can, and you probably will never know it.
You, implicitly, trust Ubuntu not to include a backdoor in these packages.
