Btw rpm package manager keeps track of checksums of metadata and content for all installed packages, so that one can verify integrity of all (rpm -Va) or a particular package (rpm -V foo) later.
Ah, cool, I didn't know that. Do you know if it uses public key signatures, or if it's simply a list of known hashes for each file of each version?
This applies to almost all modern linux package managers.
PGP is typically used to sign a collection of hashes (and other metadata). PGP is generally only used at package install/build time, and the subsequently installed/generated manifest is used when you ask the package manager to verify the package.
It just compares expected checksum from rpm database with actual state in the system.
That said, rpm supports package signing, so that it can catch a package which was tampered with and prevent it's installation.
so IIUC it's an os level tripwire ?
Yes. But I guess that tripwire has more features.
I guess the argument would be that your package manager checks the gpg trust chain provided by your repo -- but I totally understand that doesn't prevent a binary being modified once it's there on disk. Some level of protection about that is that typically apps aren't user writeable on *nix -- app signatures deal with a subtly different threat model (and arguably one in which sometimes the user is part of the threat...)
Re:Taming the BPF Superpowers
by solarengineer on Sunday October 10, 2021 @11:37AM
(#28819210)
Prelinking can change binaries as well. A combination of a Mandatory Access Control system (SELinux, AppArmour) and a Host Based Intrusion Detection system (like AIDE) could respectively help prevent and detect changes to binaries.
I'm not entirely sure if techniques such as ASLR are fool-proof enough to prevent changes to binaries in memory - I haven't studied enough about ASLR yet.
Re:Taming the BPF Superpowers
by 5e92cb50239222b on Sunday October 10, 2021 @12:37PM
(#28819745)
Minor nitpick: it's fs-verity. As a non-native English speaker I walked into that one many a time.
It kind of does - you can use IMA to enforce signature validation, even including an x509 chain. But it using extended attributes for this results in a bunch of difficulties, and there's no good distro support for it at present.
I always found it a bit odd that Linux doesn't have a standard binary signing mechanism, like Windows does through Authenticode (well, and Catalog signatures, and now a different scheme for UWL apps too).
I guess it's not quite as necessary, since on Linux you typically get apps from trusted package repositories, but personally it's still something I'd like to see, so file integrity could be verified later (even offline if wanted).