4 ms·

Article mentions fs-verify, which I'd never heard of and sounds interesting! I always found it a bit odd that Linux doesn't have a standard binary signing mech

Article mentions fs-verify, which I'd never heard of and sounds interesting! I always found it a bit odd that Linux doesn't have a standard binary signing mechanism, like Windows does through Authenticode (well, and Catalog signatures, and now a different scheme for UWL apps too). I guess it's not quite as necessary, since on Linux you typically get apps from trusted package repositories, but personally it's still something I'd like to see, so file integrity could be verified later (even offline if wanted).

azalemeth 5y ago
I guess the argument would be that your package manager checks the gpg trust chain provided by your repo -- but I totally understand that doesn't prevent a binary being modified once it's there on disk. Some level of protection about that is that typically apps aren't user writeable on *nix -- app signatures deal with a subtly different threat model (and arguably one in which sometimes the user is part of the threat...)
- solarengineer 5y ago
  Prelinking can change binaries as well. A combination of a Mandatory Access Control system (SELinux, AppArmour) and a Host Based Intrusion Detection system (like AIDE) could respectively help prevent and detect changes to binaries. I'm not entirely sure if techniques such as ASLR are fool-proof enough to prevent changes to binaries in memory - I haven't studied enough about ASLR yet.
marbu 5y ago
Btw rpm package manager keeps track of checksums of metadata and content for all installed packages, so that one can verify integrity of all (rpm -Va) or a particular package (rpm -V foo) later.
- agumonkey 5y ago
  so IIUC it's an os level tripwire ?
  - marbu 5y ago
    Yes. But I guess that tripwire has more features.
- GordonS 5y ago
  Ah, cool, I didn't know that. Do you know if it uses public key signatures, or if it's simply a list of known hashes for each file of each version?
  - dfghdfgj 5y ago
    This applies to almost all modern linux package managers. PGP is typically used to sign a collection of hashes (and other metadata). PGP is generally only used at package install/build time, and the subsequently installed/generated manifest is used when you ask the package manager to verify the package.
  - marbu 5y ago
    It just compares expected checksum from rpm database with actual state in the system. That said, rpm supports package signing, so that it can catch a package which was tampered with and prevent it's installation.
5e92cb50239222b 5y ago
Minor nitpick: it's fs-verity. As a non-native English speaker I walked into that one many a time.
mjg59 5y ago
It kind of does - you can use IMA to enforce signature validation, even including an x509 chain. But it using extended attributes for this results in a bunch of difficulties, and there's no good distro support for it at present.

azalemeth 5y ago

I guess the argument would be that your package manager checks the gpg trust chain provided by your repo -- but I totally understand that doesn't prevent a binary being modified once it's there on disk. Some level of protection about that is that typically apps aren't user writeable on *nix -- app signatures deal with a subtly different threat model (and arguably one in which sometimes the user is part of the threat...)

solarengineer 5y ago
Prelinking can change binaries as well. A combination of a Mandatory Access Control system (SELinux, AppArmour) and a Host Based Intrusion Detection system (like AIDE) could respectively help prevent and detect changes to binaries. I'm not entirely sure if techniques such as ASLR are fool-proof enough to prevent changes to binaries in memory - I haven't studied enough about ASLR yet.

marbu 5y ago

Btw rpm package manager keeps track of checksums of metadata and content for all installed packages, so that one can verify integrity of all (rpm -Va) or a particular package (rpm -V foo) later.

agumonkey 5y ago
so IIUC it's an os level tripwire ?
- marbu 5y ago
  Yes. But I guess that tripwire has more features.
GordonS 5y ago
Ah, cool, I didn't know that. Do you know if it uses public key signatures, or if it's simply a list of known hashes for each file of each version?
- dfghdfgj 5y ago
  This applies to almost all modern linux package managers. PGP is typically used to sign a collection of hashes (and other metadata). PGP is generally only used at package install/build time, and the subsequently installed/generated manifest is used when you ask the package manager to verify the package.
- marbu 5y ago
  It just compares expected checksum from rpm database with actual state in the system. That said, rpm supports package signing, so that it can catch a package which was tampered with and prevent it's installation.

5e92cb50239222b 5y ago

Minor nitpick: it's fs-verity. As a non-native English speaker I walked into that one many a time.

mjg59 5y ago

It kind of does - you can use IMA to enforce signature validation, even including an x509 chain. But it using extended attributes for this results in a bunch of difficulties, and there's no good distro support for it at present.