Bugtraq mailing list archives
Re: Installation of software, and security. . .
From: Matt Beaumont <mbeaumon () cs hmc edu>
Date: Tue, 19 Jul 2005 09:46:36 -0700
On Tue, Jul 19, 2005 at 14:01:01 +1000, Tim Nelson wrote:
My suggested solution would be to: 1. Build in to RPM (or whatever) any relatively harmless features which are regularly used (eg. reload)
That's a double-edged sword. On the one hand, a "standard library" of useful installation actions could make life easier for developers and package maintainers. On the other hand, the package management system would then also have to play nice with the idiosyncracies of the service management mechanisms on whatever systems are supported by the former.
2. Issue a security warning and quit for any packages that have pre/post install scripts, and any actions that might cause trouble (eg. reload) 3. Set --with-scripts (or something) to enable running scripts, and --with-actions to enable potentially troublesome actions (eg. reload), or --without-actions to just install files and not do the actions.
Good idea in principle, but a malicious package will just arrange to tell J. Random User to run the install with whatever dangerous flags allow the malware to do its thing, and, corollary to the "J. Random User will always just click OK" principle of user psychology, the user will follow the instructions and the box will get 0wned. Anyway, that's just my two cents. Cheers, Matt
Attachment:
_bin
Description:
Current thread:
- Installation of software, and security. . . John Richard Moser (Jul 16)
- Re: Installation of software, and security. . . Klaus Schwenk (Jul 18)
- Re: Installation of software, and security. . . John Richard Moser (Jul 18)
- Re: Installation of software, and security. . . Tim Nelson (Jul 19)
- Re: Installation of software, and security. . . Jason Coombs (Jul 19)
- RE: Installation of software, and security. . . Burton Strauss (Jul 20)
- Re: Installation of software, and security. . . John Richard Moser (Jul 20)
- Re: Installation of software, and security. . . John Richard Moser (Jul 18)
- Re: Installation of software, and security. . . Matt Beaumont (Jul 19)
- Pointless discussion (was Re: Installation of software, and security. . .) David F. Skoll (Jul 19)
- Re: Installation of software, and security. . . Klaus Schwenk (Jul 18)
- RE: Installation of software, and security. . . Burton Strauss (Jul 19)
- Re: Installation of software, and security. . . Peter Keel (Jul 20)
- Re: Installation of software, and security. . . Tino Wildenhain (Jul 19)
- Re: Installation of software, and security. . . Kerry Thompson (Jul 19)
- RE: Installation of software, and security. . . Burton Strauss (Jul 19)
- Re: Installation of software, and security. . . David F. Skoll (Jul 19)
- <Possible follow-ups>
- RE: Installation of software, and security. . . Glenn.Everhart (Jul 20)