Date: Thu, 30 Jan 2020 13:22:39 +0000 From: Glen Barber <gjb@freebsd.org> To: Nathan Dorfman <ndorf@rtfm.net> Cc: freebsd-security@freebsd.org Subject: Re: Cryptographic signatures of installer sets Message-ID: <20200130132239.GG9584@FreeBSD.org> In-Reply-To: <20200130005006.GA13@e398a4ce8009> References: <20200125200007.GA11@rtfm.net> <20200127164201.GB9584@FreeBSD.org> <20200130005006.GA13@e398a4ce8009>
next in thread | previous in thread | raw e-mail | index | archive | help
--Xzd0sUmZITcBHKTf Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi Nathan, On Thu, Jan 30, 2020 at 12:50:06AM +0000, Nathan Dorfman wrote: > On Mon, Jan 27, 2020 at 04:42:01PM +0000, Glen Barber wrote: > > No, this last part is not true. The installer always verifies the > > checksums against /usr/freebsd-dist/MANIFEST on the installation medium. > >=20 > > In particular, this was done in r293223, where the LOCAL_DISTRIBUTIONS > > variable explicitly contains the MANIFEST. >=20 > Thank you, Glen. You're correct of course; the installer uses its > embedded MANIFEST and doesn't even fetch it from the mirror... during > system installation, at least. >=20 > However, the first time a jail is set up, using the `bsdinstall jail` > command, it does in fact fetch and trust the mirror's MANIFEST. I just > tested this with a freshly installed 12.1-RELEASE system and a local > mirror with a modified base.txz and manifest. It installs the modified > files into the new jail without any complaint. >=20 > Simply, after a clean installation /usr/freebsd-dist doesn't exist on > the new system, so the jail script creates it and downloads the MANIFEST > from the mirror. See lines 60-70, here: >=20 > https://svnweb.freebsd.org/base/release/12.1.0/usr.sbin/bsdinstall/script= s/jail?view=3Dmarkup#l60 >=20 > After the first jail, this downloaded manifest and package(s) are saved > in /usr/freebsd-dist. So you are only at risk the first time, and there > will be some evidence of the tampering. Still, I hope you'll agree that > this should be fixed. The installer already has a trusted manifest as > you point out, why not simply install that one into the target system's > /usr/freebsd-dist at setup time? >=20 I honestly wasn't aware there was a jail subcommand to bsdinstall. I think, rather than creating /usr/freebsd-dist on the host system, we should instead check if the misc/freebsd-release-manifests package is installed and bail if it does not. This package contains the MANIFEST files from past releases (and in-progress releases, including BETA and RC builds). Does that seem like a reasonable solution? Glen --Xzd0sUmZITcBHKTf Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEjRJAPC5sqwhs9k2jAxRYpUeP4pMFAl4y2JoACgkQAxRYpUeP 4pNgIw/+L0cnf3PJEak7dm8nXqp8F8em/cNDnTCSoXGqHP14esvjn3w45pOsw0f8 bgBEKauvzRGZ/rurUINUEHtkjCml4VGkXHybbD+Qihg/ZQbyzaioQFAIjGaiO7Sn ++AQjvjsdiecR6cbsRhH7PqqlfvGlAtwWTN9afjuSZzUzy5rFT5rL7+/RKPVN8+w ugVyL4KwzkdJIABqw+F5pF+K96c42GPTOnMeTtveLkHH+h1tK+6zaVn/8P2XvBUB X9ejv3CbvsyUU84c2+eBsy7xD96Yyv5oFhnPPwtZ19mBu65CbH5jgtz4Owl6KBHK L//2JFw93SZQ768BK+Bm0lToaKsk0DP9OWQz9k54TeOL6DN1ZQ/PzJoxx5Mi3XQR B8+pS8//9ex6RTSX8GrMyl05S+0rfLNODM/Zu1k8D8dai0J3V2hVS4r3brn0g/ZF Uwjx4oDcI9ez15Ft/e4tFHu3Omw8gKtjmTtbBWNC4g/qg0MVC2vnx7DWE1BCf5iF fZ+Svt1XENIxDuBDFn0aLzNXNg3lwuGP6KIhbbtKxDNTAdxnvrkCvEzctkOcYStc wWfmzH4ReXSBZmibZ37pmLMJIPw6IGo72asE9cYDHV2VIHoakc8Du01+vUZ1josk mWGAxHSAHRqc0Yu98gxZqMPIkSdqUpbSRDkc0b2U5i5aY1FSFdY= =5WnG -----END PGP SIGNATURE----- --Xzd0sUmZITcBHKTf--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20200130132239.GG9584>