Can a registered 3rd party repo spoof critical packages (e.g libc6) and have them installed on apt 'upgrade' operations?
What are the best ways (configuration) to help manage 3rd party repos to constrain their capabilities.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Normally there is two main points to avoid such issues:
There is by default a limited list of trusted sources for packages download defined in your system configuration files (for instance it is below the /etc/yum.repos.d/ directory in the CentOS system I have right now at hand),
The packages themselves are signed by these repositories so you can check downloaded updates integrity using the corresponding repository public keys (usually done automatically by the update software).
This would avoid a third-party to inject corrupted updates. However, this system relies on trust: would you add any supplementary repository you implicitly trust them to not corrupt your system.