3

Can a registered 3rd party repo spoof critical packages (e.g libc6) and have them installed on apt 'upgrade' operations?

What are the best ways (configuration) to help manage 3rd party repos to constrain their capabilities.

  • No need to replace libc. It just needs to write a suid somewhere =) – miniBill Jan 23 '15 at 6:49
1

Normally there is two main points to avoid such issues:

  • There is by default a limited list of trusted sources for packages download defined in your system configuration files (for instance it is below the /etc/yum.repos.d/ directory in the CentOS system I have right now at hand),

  • The packages themselves are signed by these repositories so you can check downloaded updates integrity using the corresponding repository public keys (usually done automatically by the update software).

This would avoid a third-party to inject corrupted updates. However, this system relies on trust: would you add any supplementary repository you implicitly trust them to not corrupt your system.

| improve this answer | |
-1

This question is highly dependent on what DISTRIBUTION of Linux you are using.

but most have some way to either do preference or priority of the 'origin' or "pin" a location. but with the information given I can not tell you hoe to configure it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.