Bug 981918
| Summary: | Inexplicable differences between "identical" installations (security issue?) | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Steve <ulatekh> |
| Component: | distribution | Assignee: | Bill Nottingham <notting> |
| Status: | CLOSED WONTFIX | QA Contact: | Bill Nottingham <notting> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 18 | CC: | dennis, kevin, rvokal |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-02-05 22:04:47 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Steve
2013-07-07 01:46:30 UTC
All of those seem to be files that are generated at rpm install time via scriptlets, and contain things like timestamps/dates. Still, that doesn't explain the oddness with nss_compat_ossl and pkcs11-helper, does it? Or how practically every .mod file in /boot/grub2/i386-pc is different? Also...is the process that I outlined for creating a clean system a sensible one? None of these comparisons have any meaning if it's just as compromised as my in-use system. I guess I should have kept the first version of my possibly-compromised system, but at the time, I wasn't thinking about reporting the problem, just fixing it. (In reply to Steve from comment #2) > Still, that doesn't explain the oddness with nss_compat_ossl and > pkcs11-helper, does it? Yeah, those I think are a real prelink bug with it not unprelinking them correctly. You could test by installing prelink, reinstall and prelink one of them, unprelink and see if it fails to verify. >Or how practically every .mod file in > /boot/grub2/i386-pc is different? Those are generated at install time. > Also...is the process that I outlined for creating a clean system a sensible > one? None of these comparisons have any meaning if it's just as compromised > as my in-use system. I have no idea what threats you are trying to protect against, so I can't say if this is a good model to protect against them. This should be a good way to have a reference system sure. I ran "prelink -ua; rpm -e prelink" on both my in-use and clean systems, so hopefully the problem will go away. I'll report back here if anything else strange happens. Thanks for pointing out %ghost, i.e. files that get generated at install time and so would be different between otherwise identical installations. I'm trying to detect if/when my system gets compromised in any way. I'm hoping to maintain my "clean" system by not using it for anything but installing/updating packages, so that I can compare it to my in-use system and detect any changes, e.g. if tripwire or "rpm -V" somehow get compromised. Now that I'm running Firefox in an SELinux sandbox, without Adobe Flash, and with the noscript addon, hopefully I've closed off all possible attack vectors. I wish I could find more net.resources for this sort of thing. linux-sec.net looks decent, but has a LOT of information. This message is a reminder that Fedora 18 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 18. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '18'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 18's end of life. Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 18 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior to Fedora 18's end of life. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Fedora 18 changed to end-of-life (EOL) status on 2014-01-14. Fedora 18 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. |