From owner-freebsd-security@freebsd.org Sun Feb 2 11:37:14 2020 Return-Path: Delivered-To: freebsd-security@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id B588522A929 for ; Sun, 2 Feb 2020 11:37:14 +0000 (UTC) (envelope-from ndorf@rtfm.net) Received: from iad1-shared-relay2.dreamhost.com (iad1-shared-relay2.dreamhost.com [208.113.157.41]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 489TT552gyz42Ty; Sun, 2 Feb 2020 11:37:13 +0000 (UTC) (envelope-from ndorf@rtfm.net) Received: from iad1-shared-relay1.dreamhost.com (iad1-shared-relay1.dreamhost.com [208.113.157.50]) by iad1-shared-relay2.dreamhost.com (Postfix) with ESMTP id 6483238C78C; Sat, 1 Feb 2020 15:39:14 -0800 (PST) Received: from cloudburst.dreamhost.com (cloudburst.dreamhost.com [66.33.212.129]) by iad1-shared-relay1.dreamhost.com (Postfix) with ESMTP id 404CAB40066; Sat, 1 Feb 2020 15:34:22 -0800 (PST) Received: by cloudburst.dreamhost.com (Postfix, from userid 10401829) id 0FAD41579; Sat, 1 Feb 2020 15:34:22 -0800 (PST) Date: Sat, 1 Feb 2020 23:34:20 +0000 From: Nathan Dorfman To: Glen Barber Cc: freebsd-security@freebsd.org Subject: Re: Cryptographic signatures of installer sets Message-ID: <20200201233420.GA18@rtfm.net> References: <20200125200007.GA11@rtfm.net> <20200127164201.GB9584@FreeBSD.org> <20200130005006.GA13@e398a4ce8009> <20200130132239.GG9584@FreeBSD.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200130132239.GG9584@FreeBSD.org> X-Rspamd-Queue-Id: 489TT552gyz42Ty X-Spamd-Bar: ++++ Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=fail (mx1.freebsd.org: domain of ndorf@rtfm.net does not designate 208.113.157.41 as permitted sender) smtp.mailfrom=ndorf@rtfm.net X-Spamd-Result: default: False [4.77 / 15.00]; ARC_NA(0.00)[]; R_SPF_FAIL(1.00)[-all]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; RCVD_TLS_LAST(0.00)[]; DMARC_NA(0.00)[rtfm.net]; NEURAL_SPAM_MEDIUM(0.20)[0.198,0]; RCVD_COUNT_THREE(0.00)[3]; RBL_SENDERSCORE(2.00)[41.157.113.208.bl.score.senderscore.com]; RCPT_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_NONE(0.00)[41.157.113.208.list.dnswl.org : 127.0.5.0]; NEURAL_SPAM_LONG(0.97)[0.970,0]; IP_SCORE(0.71)[ip: (1.59), ipnet: 208.113.128.0/17(1.11), asn: 26347(0.89), country: US(-0.05)]; RWL_MAILSPIKE_POSSIBLE(0.00)[41.157.113.208.rep.mailspike.net : 127.0.0.17]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:26347, ipnet:208.113.128.0/17, country:US]; MID_RHS_MATCH_FROM(0.00)[]; FROM_EQ_ENVFROM(0.00)[] X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Feb 2020 11:37:14 -0000 On Thu, Jan 30, 2020 at 01:22:39PM +0000, Glen Barber wrote: > I honestly wasn't aware there was a jail subcommand to bsdinstall. > I think, rather than creating /usr/freebsd-dist on the host system, we > should instead check if the misc/freebsd-release-manifests package is > installed and bail if it does not. This package contains the MANIFEST > files from past releases (and in-progress releases, including BETA and > RC builds). > > Does that seem like a reasonable solution? Well, that only works for actual releases. The one from the installation medium would work in all cases, such as if one installs a snapshot, or a custom build. It would have to be kept up to date by freebsd-update, though. Also, you would need to add logic to select the correct manifest from the ones in the package, whereas one from the initial install (and freebsd-update) would be the only one. That could be as simple as stripping the -p123 suffixes from `uname -r`, but why? FWIW, the /usr/freebsd-dist location can be overridden by setting $BSDINSTALL_DISTDIR, but the checksum script[1] will expect to find the manifest and sets in the same directory regardless. Perhaps this default could be changed to something under /usr/share? -nd. [1] https://svnweb.freebsd.org/base/release/12.1.0/usr.sbin/bsdinstall/scripts/checksum?view=markup#l29