Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux AUR Repository Found to Contain Malware

sensorstechforum.com

Post reply on HN
Print view View original

11–20 of 137 posts

Re: Arch Linux AUR Repository Found to Contain Malware

#11

Post by Latty »

chimeracoder wrote: post #2

The Arch User Repository hosts whatever people want to upload to it, with basically no proactive vetting whatsoever. In addition, the installation scripts run arbitrary code, a portion of which must run with root privileges. When a package gets orphaned, that means that anybody in the community can take over maintainership of the package. There's a whole lot of trust that has to go on when installing a package from t…

> this is a fundamental problem with the security model of Arch Linux

And with every other OS that isn't locked down so the user can't run arbitrary stuff.

The AUR is just the arch equivalent of downloading a `.exe` installer and running it. Yes, clearly there are security concerns there, but they aren't specific to Arch.

If you want a level of trust, then don't build AUR packages and install things using the package manager (AUR packages aren't supported by it) which have trusted maintainers and are signed.

Re: Arch Linux AUR Repository Found to Contain Malware

#12

Post by mar77i »

mateuszf wrote: post #8
dozzie wrote: post #3

Earlier quoted context omitted.

The thing is not that it's a new deficiency or something, it's just that Arch user conveniently ignore this when praising their distribution over e.g. Debian.

AUR repository isn't supported by the core tools and packages. To use it one has to install external scripts. So it's by no means part of the system.

Urm, you need git, you need build tools... and pacman.

That's it. But oh yeah, because I do these things by hand and check whether the source urls point to the place I'd actually like to install (and other code doesn't download external sources, eg. in the PKGBUILD or external scripts like *.install files), I'm suddenly an exception.

I just noticed that the blue used on the Archlinux logo is actually quite consistent with Rick's hair color. https://i.imgur.com/kkE25w2.jpg Fits me. I don't give a damn.

Re: Arch Linux AUR Repository Found to Contain Malware

#13

Post by 21 »

cmiles74 wrote: post #4

From the article: "This is yet another incident that showcases that Linux users should not explicitly trust user-controlled repositories." LOL. Why should this only apply to Linux users? We should all be wary of downloading random things from websites. AUR has always been labeled "user submitted", but I guess it's easy to forget that some "users" are really out to cause harm.

Because there is this myth that only Windows users get infected because Windows is insecure, that packages are vetted, that code being open source means that a backdoor insertion would quickly be discovered, and so on.

Re: Arch Linux AUR Repository Found to Contain Malware

#14

Post by tomn »

chimeracoder wrote: post #2

The Arch User Repository hosts whatever people want to upload to it, with basically no proactive vetting whatsoever. In addition, the installation scripts run arbitrary code, a portion of which must run with root privileges. When a package gets orphaned, that means that anybody in the community can take over maintainership of the package. There's a whole lot of trust that has to go on when installing a package from t…

> this is a fundamental problem with the security model of Arch Linux, but that's been known for a very long time

It's exactly the same problem that every other distro has when users compile or install unvetted community packages.

The only way to make unvetted community repositories safe is to have users look at the sources before building or installing. Arch encourages users to do that -- AUR helpers and binary repositories are discouraged, and the source package format is simple enough that an average user could probably spot something like this.

Re: Arch Linux AUR Repository Found to Contain Malware

#15

Post by LukeShu »

chimeracoder wrote: post #2

The Arch User Repository hosts whatever people want to upload to it, with basically no proactive vetting whatsoever. In addition, the installation scripts run arbitrary code, a portion of which must run with root privileges. When a package gets orphaned, that means that anybody in the community can take over maintainership of the package. There's a whole lot of trust that has to go on when installing a package from t…

> yes, this is a fundamental problem with the security model of Arch Linux

No, it's not. AUR is not Arch, and is not "supported" by Arch.

It's a fundamental problem with the security model running code from randos on the internet. If someone published a git repo on GitHub that installed malware when you ran

    git clone git://github.com/user/repo . && ./configure && make && sudo make install
you wouldn't be saying that "this is a fundamental problem with the security model of git."

From the AUR homepage, in big text:

> AUR packages are user produced content. Any use of the provided files is at your own risk.

Re: Arch Linux AUR Repository Found to Contain Malware

#16

Post by craftyguy »

lerax wrote: post #5

Not a surprise.

Yes, but this may be a good reminder for fellow Arch users who have grown complacent reviewing things they install from AUR.

I've gotten to the point where I do not install any AUR helpers on my systems, and manually download PKGBUILDs and install with makepkg. These extra steps force me to 1) review the PKGBUILD + *.install files, and 2) make me reconsider whether or not I want to go through the effort for a package (i.e. "do I really want this thing")

If you want to see all software installed from outside repos defined in /etc/pacman.conf, you can use this pacman option:

    pacman -Qm
It's always a good idea to periodically review this list as well.

Re: Arch Linux AUR Repository Found to Contain Malware

#17

Post by dozzie »

mateuszf wrote: post #8
dozzie wrote: post #3

Earlier quoted context omitted.

The thing is not that it's a new deficiency or something, it's just that Arch user conveniently ignore this when praising their distribution over e.g. Debian.

AUR repository isn't supported by the core tools and packages. To use it one has to install external scripts. So it's by no means part of the system.

Which, as I said, very conveniently is glossed over by Arch users.

Re: Arch Linux AUR Repository Found to Contain Malware

#18

Post by cmiles74 »

farresito wrote: post #9
dvfjsdhgfv wrote: post #6

Earlier quoted context omitted.

Fortunately admins are not unreasonable and don't base their decisions on praises but on actual merits, so most servers run Debian rather than Arch (which is an interesting distro for other usage cases).

Who would want to use a rolling release distribution for a (production) server? Sounds like a pretty terrible choice, to be quite honest.

Maybe you could make the case for some cutting edge development or test box, but then again, I'd rather be testing on something that's as close to identical to the production environment as possible.

I used Arch on my laptop (primarily used for development) for several years. It mostly worked great and I always had access to the newest whatever with a minimum of hassle. I don't have many complaints, but occasionally after an update something critical would stop working.

I'm on Solus now and, so far, it's been pretty great. :-)

Re: Arch Linux AUR Repository Found to Contain Malware

#19

Post by Foxboron »

mar77i wrote: post #12
mateuszf wrote: post #8

Earlier quoted context omitted.

AUR repository isn't supported by the core tools and packages. To use it one has to install external scripts. So it's by no means part of the system.

Urm, you need git, you need build tools... and pacman. That's it. But oh yeah, because I do these things by hand and check whether the source urls point to the place I'd actually like to install (and other code doesn't download external sources, eg. in the PKGBUILD or external scripts like *.install files), I'm suddenly an exception. I just noticed that the blue used on the Archlinux logo is actually quite consistent…

I'll assure you Rick has a blue-grayish color while the Arch logo is Navy Blue.

Re: Arch Linux AUR Repository Found to Contain Malware

#20

Post by Foxboron »

farresito wrote: post #9
dvfjsdhgfv wrote: post #6

Earlier quoted context omitted.

Fortunately admins are not unreasonable and don't base their decisions on praises but on actual merits, so most servers run Debian rather than Arch (which is an interesting distro for other usage cases).

Who would want to use a rolling release distribution for a (production) server? Sounds like a pretty terrible choice, to be quite honest.

All of the Arch Linux infrastructure is run on Arch. Works pretty well.
Post reply on HN