yaourt security warning

Llama · 2009-06-09 14:56:34

Hi,

First Submitted: Thu, 06 Dec 2007 16:55:19 +0000
gnubg 20090412-1 : Backgammon
( Unsupported package: Potentally dangerous ! )
==> Edit the PKGBUILD (highly recommended for security reasons) ? [Y/n]("A" to abort)
==> ----------------------------------------------
==>

What am I supposed to do about it?

lucke · 2009-06-09 14:58:48

I believe it tries to say that blindly (i.e. without checking PKGBUILDs and .install files) installing software from AUR isn't a good idea.

Last edited by lucke (2009-06-09 15:00:54)

Llama · 2009-06-09 15:16:45

lucke wrote:

I believe it tries to say that blindly (i.e. without checking PKGBUILDs and .install files) installing software from AUR isn't a good idea.

Ah... What am I supposed to spot there? Trojan's banner?

lucke · 2009-06-09 16:07:51

Things like "rm -rf /"?

Army · 2009-06-09 16:10:02

Llama wrote:

Ah... What am I supposed to spot there? Trojan's banner?

rm -rf /

in the build function for example ;-)

tdy · 2009-06-09 18:25:45

Army wrote:

in the build function for example ;-)

It would have to be in the .install file to do any tangible harm unless you run makepkg as root for some strange reason.. although I'm sure the package would be a dud anyway if they did put that in the PKGBUILD.

Last edited by tdy (2009-06-09 19:06:44)

Army · 2009-06-09 22:46:03

tdy wrote:

Army wrote:
in the build function for example ;-)
It would have to be in the .install file to do any tangible harm unless you run makepkg as root for some strange reason.. although I'm sure the package would be a dud anyway if they did put that in the PKGBUILD.

Of course you are right ;-) But I would hate to lose all my files in home ;-)

lucke · 2009-06-09 22:51:03

I'm not sure how fakeroot is supposed to work, but I did manage to delete a dir in / from within build().

skottish · 2009-06-10 03:36:39

On top of the install files, it's always a good idea to know where software is coming from. Anyone can submit anything to AUR with sources that are malware, knowingly or not. There's a very real risk of users voluntarily installing rouge software, and as Linux becomes more popular, we'll so more and more repos full of this garbage.

*** The greatest risk that Linux will become like Windows comes from it's user base ***

Llama · 2009-06-10 11:19:53

skottish wrote:

On top of the install files, it's always a good idea to know where software is coming from. Anyone can submit anything to AUR with sources that are malware, knowingly or not. There's a very real risk of users voluntarily installing rouge software, and as Linux becomes more popular, we'll so more and more repos full of this garbage.

That's obvious. The question is, how much can I see looking into a port from AUR. What kind of effort is worth putting into it?

tdy · 2009-06-11 04:28:48

Llama wrote:

What kind of effort is worth putting into it?

well that's a question only you can answer.. the amount of effort depends on how safe you want to be..

louipc · 2009-06-19 12:28:38

lucke wrote:

I'm not sure how fakeroot is supposed to work, but I did manage to delete a dir in / from within build().

From the fakeroot man page:

fakeroot runs a command in an environment wherein it appears to have root privileges for file manipulation.

Fakeroot only makes you appear to have root privileges. A PKGBUILD could potentially destroy anything that your user has access to.
If you want complete peace of mind, you should build under a special build user that doesn't have access to anything important.

I think that if we keep diligent on security there'll be less motivation for people to submit malicious PKGBUILDs. If we're soft on security, then it'll be easier to affect the system, and there may be more motivation to create bad PKGBUILDs.

Mr.Elendig · 2009-06-19 13:12:24

What you really want to spot, is stupid things in the PKGBUILDs like:

rm -r /usr/include/foobar/*
cp $srcdir/foobar.so /usr/lib/foobar.so.5

instead of:

rm -r $pkgdir/usr/include/foobar/*
cp $srcdir/foobar.so $pkgdir/usr/lib/foobar.so.5

Arch Linux

#1 2009-06-09 14:56:34

yaourt security warning

#2 2009-06-09 14:58:48

Re: yaourt security warning

#3 2009-06-09 15:16:45

Re: yaourt security warning

#4 2009-06-09 16:07:51

Re: yaourt security warning

#5 2009-06-09 16:10:02

Re: yaourt security warning

#6 2009-06-09 18:25:45

Re: yaourt security warning

#7 2009-06-09 22:46:03

Re: yaourt security warning

#8 2009-06-09 22:51:03

Re: yaourt security warning

#9 2009-06-10 03:36:39

Re: yaourt security warning

#10 2009-06-10 11:19:53

Re: yaourt security warning

#11 2009-06-11 04:28:48

Re: yaourt security warning

#12 2009-06-19 12:28:38

Re: yaourt security warning

#13 2009-06-19 13:12:24

Re: yaourt security warning

Board footer