From owner-freebsd-current@FreeBSD.ORG Sun Aug 26 12:58:50 2012 Return-Path: Delivered-To: current@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 7429E106566B; Sun, 26 Aug 2012 12:58:50 +0000 (UTC) (envelope-from bapt@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 399198FC0A; Sun, 26 Aug 2012 12:58:50 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q7QCwoOX005341; Sun, 26 Aug 2012 12:58:50 GMT (envelope-from bapt@FreeBSD.org) Received: (from bapt@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q7QCwn2B005340; Sun, 26 Aug 2012 12:58:49 GMT (envelope-from bapt@FreeBSD.org) X-Authentication-Warning: freefall.freebsd.org: bapt set sender to bapt@FreeBSD.org using -f Date: Sun, 26 Aug 2012 14:58:47 +0200 From: Baptiste Daroussin To: Jilles Tjoelker Message-ID: <20120826125846.GD37534@ithaqua.etoilebsd.net> References: <97612B57-1255-4BB3-A6D3-FC74324C6D67@FreeBSD.org> <20120824081543.GB2998@ithaqua.etoilebsd.net> <50380269.6020003@FreeBSD.org> <20120825000148.GF37867@ithaqua.etoilebsd.net> <50396113.3080607@cyberleo.net> <20120826122649.GA8995@stack.nl> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="jL2BoiuKMElzg3CS" Content-Disposition: inline In-Reply-To: <20120826122649.GA8995@stack.nl> User-Agent: Mutt/1.5.21 (2010-09-15) Cc: CyberLeo Kitsana , ports@FreeBSD.org, Doug Barton , current@FreeBSD.org, Steve Wills Subject: Re: pkgng suggestion: renaming /usr/sbin/pkg to /usr/sbin/pkg-bootstrap X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Aug 2012 12:58:50 -0000 --jL2BoiuKMElzg3CS Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Aug 26, 2012 at 02:26:50PM +0200, Jilles Tjoelker wrote: > On Sat, Aug 25, 2012 at 06:34:43PM -0500, CyberLeo Kitsana wrote: > > On 08/24/2012 07:01 PM, Baptiste Daroussin wrote: > > > Can anyone give me he details on the security related problem? >=20 > > Off the top of my head, it seems to represent a break in the chain of > > trust: how does the bootstrapper verify that the tarball it just > > downloaded to bootstrap pkg is genuine, and not, for example, a > > trojan? The source in usr.sbin/pkg/pkg.c[1] doesn't seem to suggest it > > cares. >=20 > Indeed it does not care, and the current security features are > insufficient (unless the bootstrapper can use the signed sqlite db to > verify the pkg package). >=20 > I think the fix is to modify 'pkg repo' so it detects the pkg package > and creates a separate signature for it which can be verified by the > bootstrapper, without needing sqlite. >=20 > The public key for this signature will have to be distributed with base > (like the public keys for freebsd-update and portsnap). >=20 The is the longer plan but this with also true with pkg_add -r, and the pkg bootstrap may it be pkg-bootstrap or /usr/sbin/pkg. We have been discussing= with Security officers and we are waiting for the plan being written and setup by them, so we can improved security in both pkgng and the bootstrap. This sho= uld have happen in BSDCan, but lack of time from everyone, didn't made it happe= n, we are now aiming at Cambridge DevSummit for that. Given that such a security issue is already in with the current pkg_* tools= , it was accepting that we can still go that way until the policy is written, gi= ven that the final goal is to have the pkgng package checked against a signatur= e. regards, Bapt --jL2BoiuKMElzg3CS Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlA6HYYACgkQ8kTtMUmk6EzvzQCgltM9CLmaMutowIChrWpW5VAV lPoAoLD8owvCwwd5+uYNfA8q6X1ygxbZ =dloA -----END PGP SIGNATURE----- --jL2BoiuKMElzg3CS--