grml-debootstrap apt-get unsigned package install security bug workaround

phabricator-migrator · February 19, 2024, 5:52pm

Information

ID: 119
PHID: PHID-TASK-ptbhnv3rzasa7pmysb4q
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: High

Description

It combines apt-get install with --yes and --force-yes, which could lead to installation of unsigned packages.

Happens only for jessie and later based builds.

upstream bug report:

github.com/grml/grml-debootstrap

Git HEAD: Potential issues with "apt-get --force-yes ..."

opened 03:09PM - 24 Jan 15 UTC

closed 06:44AM - 10 Jun 15 UTC

hartwork

upstream

Hi! I found that the chroot script of grml-deboostrap may call `apt-get --forc…e-yes ...` as of https://github.com/grml/grml-debootstrap/blob/master/chroot-script#L31 if `/usr/bin/aptitude` is missing inside the chroot. ~~Since debootstrap itself seems to install aptitude (I checked for wheezy, only) this _may_ not be much of a practical problem right now.~~ Nevertheless, I am worried that `--force-yes` may lead to installation of packages that fail GPG verification checks, in some weird scenarios already or in in new scenarios in the future. The man page of `apt-get` says ``` --force-yes Force yes; this is a dangerous option that will cause apt to continue without prompting if it is doing something potentially harmful. It should not be used except in very special situations. Using force-yes can potentially destroy your system! ``` I would therefore suggest removing the `--force-yes` parameter. What do you think?

Comments

Patrick

2015-01-27 00:22:54 UTC

Patrick

2015-02-04 03:32:25 UTC

Tested the workaround. Looked how grml-debootstrap would call it.

~ $ sudo su
root@host:/home/user# 
root@host:/home/user# DEBIAN_FRONTEND=noninteractive apt-get --force-yes -y --no-install-recommends install -o Acquire::http::Timeout=180 -o Acquire::ftp::Timeout=180 -o Acquire::Retries=3 -o Acquire::Check-Valid-Until=false -o APT::Get::force-yes=0 libreoffice
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libavahi-core7 libdaemon0
Use 'apt-get autoremove' to remove them.
The following extra packages will be installed:
  fonts-sil-gentium-basic libcolamd2.7.1 libhsqldb-java liblucene2-java libreoffice-base libreoffice-calc libreoffice-draw libreoffice-filter-mobiledev libreoffice-impress
  libreoffice-report-builder-bin libservlet2.5-java libvisio-0.0-0 lp-solve ttf-sil-gentium-basic
Suggested packages:
  java-virtual-machine libhsqldb-java-doc libhsqldb-java-gcj hunspell-dictionary libreoffice-help-3.5 libreoffice-l10n-3.5 unixodbc cups-bsd libsane hyphen-hyphenation-patterns
  mythes-thesaurus libreoffice-grammarcheck libreoffice-gnome libreoffice-kde openclipart-libreoffice pstoedit gstreamer0.10-plugins-ugly libreoffice-officebean libmyodbc
  odbc-postgresql libsqliteodbc tdsodbc mdbtools libmysql-java libpg-java libjtds-java libreoffice-gcj libreoffice-report-builder
Recommended packages:
  fonts-sil-gentium libcommons-beanutils-java libcommons-collections3-java libcommons-compress-java libcommons-digester-java libcommons-logging-java libdb-java libdb-je-java
  libicu4j-java libjline-java libjtidy-java libregexp-java ttf-liberation ttf-mscorefonts-installer
The following NEW packages will be installed:
  fonts-sil-gentium-basic libcolamd2.7.1 libhsqldb-java liblucene2-java libreoffice libreoffice-base libreoffice-calc libreoffice-draw libreoffice-filter-mobiledev
  libreoffice-impress libreoffice-report-builder-bin libservlet2.5-java libvisio-0.0-0 lp-solve ttf-sil-gentium-basic
0 upgraded, 15 newly installed, 0 to remove and 0 not upgraded.
Need to get 19.3 MB of archives.
After this operation, 60.1 MB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
  fonts-sil-gentium-basic libcolamd2.7.1 libservlet2.5-java libhsqldb-java liblucene2-java lp-solve libreoffice-calc libvisio-0.0-0 libreoffice-draw libreoffice-impress
  libreoffice-base libreoffice-report-builder-bin ttf-sil-gentium-basic libreoffice-filter-mobiledev libreoffice
E: There are problems and -y was used without --force-yes
root@host:/home/user#

The workaround isn’t pretty. Would be better if upstream fixed it. But the workaround is sufficient.