6 ms·

A large portion of people and distributions take the kernel from tarballs, not from the git. So, this is very annoying for people who took kernels tarballs in

by jbk 15y ago

A large portion of people and distributions take the kernel from tarballs, not from the git. So, this is very annoying for people who took kernels tarballs in the past from kernel.org. Sure, they can regenerate all the tarballs from the git repositories, but this isn't the point for the past actions.

stygianguest 15y ago
Perhaps this is a good opportunity to change that. Actually, I'd expect at least the bigger distributions to use git already. Git enables them to pick and choose from the updates and merge it with their own patches (alternative schedulers and the like). But you're right, as long as they serve tarballs, they should make sure they are safe. I've rolled some kernels myself and always used th e tarballs from kernel.org. Time to practice what I preach an rebuild from git.
marbu 15y ago
All tarbals are signed via linux kernel archives gpg key, which according to the kernel.org security breach announcement was not compromised. So I don't see a problem here.
- recoiledsnake 15y ago
  Don't you see the problem with the server hosting both the tar balls and the signature being compromised?
  - bonzoesc 15y ago
    The signature can be validated with a public key not available on the server.
    - recoiledsnake 15y ago
      "can be' is different from 'is'. Since the attackers had root, what if they served up rootkitted kernels 1% of the time someone downloaded a tar ball?
      - bonzoesc 15y ago
        The downloaders will have to be aware of the "no warranty" clause of the license Linux uses, and take responsibility for the software they bring into their environment. The kernel developers provide instructions[1] on how to cryptographically verify the authenticity of a downloaded kernel, including building a PGP "trust path" to their key. 1: http://kernel.org/signature.html http://kernel.org/signature.html
        recoiledsnake 15y ago
        The signatures themselves are hosted on kernel.org...
        bonzoesc 15y ago
        So? An attacker's not going to have the private key they were created with, and probably won't have a private key that you have an existing trust relationship to.
  - marbu 15y ago
    The linux kernel archive public key (which is needed to verify the signature) is well known and many people have it's own copy for several years. But if the atacker gained access to the private key, he would be able to sign trojanized tarballs without anybody noticing. On the one hand kernel.org page doesn't mention this kind of breach and the key is still used, on the other hand there are rumors (https://lwn.net/Articles/457142/ https://lwn.net/Articles/457142/) that the private key was available on the compromised server so that the atacker could produce trojanized tarballs with proper signature - but I find it unlikely because the kernel.org admins doesn't warn users about it and haven't changed the key.

by jbk 15y ago

stygianguest 15y ago

Perhaps this is a good opportunity to change that. Actually, I'd expect at least the bigger distributions to use git already. Git enables them to pick and choose from the updates and merge it with their own patches (alternative schedulers and the like). But you're right, as long as they serve tarballs, they should make sure they are safe. I've rolled some kernels myself and always used th e tarballs from kernel.org. Time to practice what I preach an rebuild from git.

marbu 15y ago

All tarbals are signed via linux kernel archives gpg key, which according to the kernel.org security breach announcement was not compromised. So I don't see a problem here.

recoiledsnake 15y ago
Don't you see the problem with the server hosting both the tar balls and the signature being compromised?
- bonzoesc 15y ago
  The signature can be validated with a public key not available on the server.
  - recoiledsnake 15y ago
    "can be' is different from 'is'. Since the attackers had root, what if they served up rootkitted kernels 1% of the time someone downloaded a tar ball?
    - bonzoesc 15y ago
      The downloaders will have to be aware of the "no warranty" clause of the license Linux uses, and take responsibility for the software they bring into their environment. The kernel developers provide instructions[1] on how to cryptographically verify the authenticity of a downloaded kernel, including building a PGP "trust path" to their key. 1: http://kernel.org/signature.html http://kernel.org/signature.html
      - recoiledsnake 15y ago
        The signatures themselves are hosted on kernel.org...
        bonzoesc 15y ago
        So? An attacker's not going to have the private key they were created with, and probably won't have a private key that you have an existing trust relationship to.
- marbu 15y ago
  The linux kernel archive public key (which is needed to verify the signature) is well known and many people have it's own copy for several years. But if the atacker gained access to the private key, he would be able to sign trojanized tarballs without anybody noticing. On the one hand kernel.org page doesn't mention this kind of breach and the key is still used, on the other hand there are rumors (https://lwn.net/Articles/457142/ https://lwn.net/Articles/457142/) that the private key was available on the compromised server so that the atacker could produce trojanized tarballs with proper signature - but I find it unlikely because the kernel.org admins doesn't warn users about it and haven't changed the key.