2 ms·

I guess the argument would be that your package manager checks the gpg trust chain provided by your repo -- but I totally understand that doesn't prevent a bina

I guess the argument would be that your package manager checks the gpg trust chain provided by your repo -- but I totally understand that doesn't prevent a binary being modified once it's there on disk. Some level of protection about that is that typically apps aren't user writeable on *nix -- app signatures deal with a subtly different threat model (and arguably one in which sometimes the user is part of the threat...)

solarengineer 5y ago
Prelinking can change binaries as well. A combination of a Mandatory Access Control system (SELinux, AppArmour) and a Host Based Intrusion Detection system (like AIDE) could respectively help prevent and detect changes to binaries. I'm not entirely sure if techniques such as ASLR are fool-proof enough to prevent changes to binaries in memory - I haven't studied enough about ASLR yet.