What Are the Security Implications of not Completely Signing Database?

Question

Hello everyone,
What are the security implications of not completely signing the database?
From http://www.archlinux.org/pacman/ ,
The following quote implies that the database exists merely just in case hand tweaking is necessary:
maintains a text-based package database (more of a hierarchy), just in case some hand tweaking is necessary.
However, considering that there are cases that pacman's local database needs to be restored, there are implications that the database is essential for pacman to function properly.
From https://wiki.archlinux.org/index.php/Ho … l_Database :
Restore pacman's local database
Signs that pacman needs a local database restoration:
- pacman -Q gives absolutely no output, and pacman -Syu erroneously reports that the system is up to date.
- When trying to install a package using pacman -S package, and it outputs a list of already satisfied dependencies.
- When testdb (part of pacman) reports database inconsistency.
Most likely, pacman's database of installed software, /var/lib/pacman/local, has been corrupted or deleted. While this is a serious problem, it can be restored by following the instructions below.
I know that all official packages (from core, extra, community, etc.) are signed so that all files should be safe, but I'm just paranoid.
What if the database was hacked?  Will this lead to installation of harmful software?
Sincerely,
Cylinder57
Last edited by Cylinder57 (2012-10-15 03:42:31)

Answer 1

Cylinder57 wrote:
From this quote:
Allan wrote:But, the OP (also?) talks about the local package database on his computer.  That is not signed at all as there is no point.  If someone can modify that, then they can regenerate the signature, or just modify any other piece of software on your computer.
Is it going to be easy for anyone other than the authorized user to modify the local package database?
Allan basically answered that with the quote above already as I understand it. Someone who has access to the installation, e.g. is able chrooting your PC via USB, is not held back by any ACLs. However, modifying the local database only makes limited sense because the packages are already installed. Pacman would only recheck, if you re-install a package. The only really relevant attack vector for the package database is
(1) installing an older package with a vulnerability,
(2) re-placing the up-to-date package sig in the local database with the older one and
(3) modifying the system, e.g. via pacman.conf excludes, to not update that.
then also re-installing would not create a sig-error and you get stuck with the bogus old package.
With a signed database this would not be possible. However, as Allan wrote earlier also with a signed database that criminal can manually install (totally leaving pacman & package cache) whatever it needs in this scenario. So, if you are -really- paranoid about that, you probably want to spend (a lot of configuring) time with something like the "aide" package.
Cylinder57 wrote:
And, are the following statements correct:
If the repository databases are modified, the hacker might be able to modify the packages on the server (Considering that if someone can modify the local package database, that person can modify any other piece of software on that particular computer.)
However, pacman won't let users from installing the modified packages (due to package signing,) unless at one person with access is bribed (at least, for an individual package.)
I don't know the intricacies of the server infrastructure - only saw they have great names :-), but I am pretty certain your statements assume that correctly. It is pretty unlikely that someone able to modify the central repository database fails at placing a bogus package for shipping with those access rights at this time. Yet it does no harm not to post any details of such a scenario here imo. In any case: A compromised mirror would be enough for that - and easier to achieve (hacked anywhere or e.g. in a non-democratic state). Plus you also answered it yourself. The keys are key for our safety there. Which keeps me hoping that no criminal lawnmover salesmen frequent the Brisbane area.
As you put up a thread about this, one question you can ask yourself is:
Have you always checked on updates new signatures keys which pacman asks about? If you ever pressed "accept/enter" without checking them out-of-band (e.g. the webserver), that compromised mirror database might have just created a "legitimate" key .. user error, but another attack vector the database signing would catch.
edit: Re-thinking the last paragraph just after posting, I now believe it would not be that easy as implied - simply because the bogus key is not trusted by one of the master keys. The pacman pgp trust model should catch that without database signing. At least it would if only the official repositories are activated, but that's a pre-requisite to the whole thread.
Last edited by Strike0 (2012-10-20 23:01:26)