[SOLVED] Does pacstrap leak any security information into a new?

NuRichard · 2018-05-03 15:09:48

Hello,

I am preparing some custom arch linux images for testing prior to deployment as an alternative to some CentOS images that I have previously used.

Following the wiki I was able to bootstrap a prepare a suitable x86_64 PC image and insert anything I need into the bootable image as part of a build process.

Just to satisfy some paranoia, I wanted to check that pacstrap does not add identifyable information or keys from the host system that I did not explicitly (and separately) add myself before I risk inadvertently exposing something useful to an attacker.

The pacstrap invocation I am using is:

pacstrap /mnt base lvm2 grub net-tools

I am hoping that someone knows if the above command leaks anything that might be comment worthy from a security perspective such as:
* Unique hardware Ids (e.g. mac addresses)
* Host computer name / domain / user
* Site networking information

I am having the rest of the image preparation audited by our internal security team and they didn't know about pacstrap to be able to comment.

I couldn't find any warnings in the wiki / via forum search / using a google search (but that may just be my inexperience and not knowing the correct term)

I don't believe there can be security audits of a continuously updating distribution, but there may be some relevant wisdom hiding away in someones head and I wouldn't want to miss out on it.

My thanks for your assistance

Last edited by NuRichard (2018-05-03 22:24:17)

Scimmia · 2018-05-03 15:13:01

It copies the mirrorlist and the pacman keyring over by default. The former shouldn't be much of an issue, the latter is if it's not generated fresh when you load the system (this is what the official install ISO does, but would be extremely unusual on an actual system).

Last edited by Scimmia (2018-05-03 15:19:12)

eschwartz · 2018-05-03 15:56:07

$ pacstrap -h

    -M             Avoid copying the host's mirrorlist to the target
    -G             Avoid copying the host's pacman keyring to the target

You should initialize the keyring yourself, either when booting into the installed system or by chrooting in and running "pacman-key --init && pacman-key --populate archlinux", except:

On the install ISO which uses a systemd service running immediately after boot to generate a brand-new pacman-key keyring which is then used for installing the new system. Since a new one is created on every boot of the ISO, you don't end up with multiple systems sharing a private master key.
Or, when using the devtools package to create arch nspawn containers you actually do want to use your host system's configuration.

Neither is the case here, so use the power of pacstrap's command-line options to empower you.

Beyond that, the only thing happening is packages being untar'ed inside a chroot, then setting up via their post-install scripts. I'm not aware of any packages that utilize e.g. hardware info at that stage (although for some things, G-d only knows what they collect at runtime, but there's nothing pacman can do about that).

If you'd like to know what any given package does in the install script, you can use the command "pacscripts $package_name" to view it.

Slithery · 2018-05-03 16:26:06

In case you hadn't found this yet...

https://git.archlinux.org/arch-install- … acstrap.in

NuRichard · 2018-05-03 22:25:07

Thank you for your help

Arch Linux

#1 2018-05-03 15:09:48

[SOLVED] Does pacstrap leak any security information into a new?

#2 2018-05-03 15:13:01

Re: [SOLVED] Does pacstrap leak any security information into a new?

#3 2018-05-03 15:56:07

Re: [SOLVED] Does pacstrap leak any security information into a new?

#4 2018-05-03 16:26:06

Re: [SOLVED] Does pacstrap leak any security information into a new?

#5 2018-05-03 22:25:07

Re: [SOLVED] Does pacstrap leak any security information into a new?

Board footer