Pin priorities to exclude non-targeted packages from third-party repositories #95

New Issue

Closed

opened 2022-07-22 17:47:31 +00:00 by benjaoming · 0 comments

benjaoming commented

2022-07-22 17:47:31 +00:00

Owner

For instance, say that we are running the official lib-very-important-4.9.9.security-patch20220101, then an attacker can place lib-very-important-5.0 with a known vulnerability and we'd just install it. They can even AFAIK just copy the package straight, but they will have to update the repository index with Dell's signing key.

But parts of this should be possible to mitigate:

Create a file /etc/apt/preferences.d/dell with contents:

Explanation: Deny all packages from this repo that exist elsewhere
Package: *
Pin: origin "linux.dell.com"
Pin-Priority: 400

In #90, we added a new repository hosted by Dell. We want specific packages from this repo, but an attacker can place all sorts of packages there and we can upgrade to a compromised package in this way. For instance, say that we are running the official lib-very-important-4.9.9.security-patch20220101, then an attacker can place lib-very-important-5.0 with a known vulnerability and we'd just install it. They can even AFAIK just copy the package straight, but they will have to update the repository index with Dell's signing key. But parts of this should be possible to mitigate: Create a file `/etc/apt/preferences.d/dell` with contents: ``` Explanation: Deny all packages from this repo that exist elsewhere Package: * Pin: origin "linux.dell.com" Pin-Priority: 400 ```

👍 1