Can a registered 3rd party repo spoof critical packages (e.g libc6) and have them installed on apt 'upgrade' operations?

What are the best ways (configuration) to help manage 3rd party repos to constrain their capabilities.

  • No need to replace libc. It just needs to write a suid somewhere =)
    – miniBill
    Jan 23, 2015 at 6:49

2 Answers 2


Normally there is two main points to avoid such issues:

  • There is by default a limited list of trusted sources for packages download defined in your system configuration files (for instance it is below the /etc/yum.repos.d/ directory in the CentOS system I have right now at hand),

  • The packages themselves are signed by these repositories so you can check downloaded updates integrity using the corresponding repository public keys (usually done automatically by the update software).

This would avoid a third-party to inject corrupted updates. However, this system relies on trust: would you add any supplementary repository you implicitly trust them to not corrupt your system.


This question is highly dependent on what DISTRIBUTION of Linux you are using.

but most have some way to either do preference or priority of the 'origin' or "pin" a location. but with the information given I can not tell you hoe to configure it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .