Numerous Debian Project systems compromised

Numerous Debian Project systems compromised

Posted Nov 22, 2003 9:44 UTC (Sat) by NAR (subscriber, #1313)
In reply to: Numerous Debian Project systems compromised by IkeTo
Parent article: Numerous Debian Project systems compromised

You have no idea of what a package actually does. Most packages must be installed as root.

I do have an a idea what a package actually does, altough my experience is with Solaris packages - however, the ideas are the same. In Solaris, the installation of a package goes through 5 distinct phases:

1. request: the package asks the user various questions (e.g. the port where the installed daemon should listen).
2. checkinstall: checks if the system is ready to install the package. In our project a "security daemon" supplies the username/password (used to login to the database, etc.) for the other applications. We use this during install so we have to check whether this daemon runs or not.
3. preinstall: make some modifications to the system before the files of the package are copied to the system.
4. the actual copying of the files (this also sets the rights and ownership of the files).
5. postinstall: make some modification on the installed package (e.g. write the config variables got during request into the config file).

On Solaris, the checkinstall phase runs as nobody user. It sounds a good idea that the other phases should run also as nobody, however, it caused us some problems - the above mentioned "security daemon" accepts connections only from specific users, so there are a lots of "su" commands in our install code and we couldn't place all of our checks into the checkinstall phase :-( I think that in this case one size does not fit all - for some packages it might be feasible that only the actual copying runs as root (e.g. if the package installs under /usr). For some packages even this might not bee needed (I saw a system where a "program installer" user had write rights on /usr/local - he only installed programs from source, but this technique might be applied to binary packages). But there are packages where more phases should run as root.

Bye,NAR

---

(Log in to post comments)