[PATCH 3/4] DNFpayload: disable all NSS operations in RPM.

Ales Kozumplik akozumpl at redhat.com
Thu Sep 12 08:53:07 UTC 2013


On 09/11/2013 04:35 PM, Chris Lumens wrote:
>> Due to a serious problem with NSS and fork() the Payload will have to do without
>> crypto.
>>
>> Related:RhBug:1006280
>
> What are the practical consequences of this?

The phase where rpm checks the digest and signing of the package *during 
transaction* is skipped. But DNF checks digests of any package 
downloaded from a repo already. The only thing we are losing 
security-wise is if somebody managed to get a spoofed package into the 
repo and then get the metadata to be generated against that. Which is 
hard to imagine to be happening for Fedora and if it can happen at a 
third party repo then they can also sign the package properly.

We are gaining some performance (computing the hashes is not for free) 
and of course we avoid the SIGSEGVs in RPM.

In theory, once the Payload is in wide use, someone with a reasonable 
security background might come and explain and complain. Then there's 
two options:

1) 1006280 will get fixed and I'll reenable the crypto in RPM.
2) In case the maintainers refuse to fix 1006280 ('keep up being 
unhelpful' is how some people might put it) the DNF Payload will have to 
drop the multiprocessing approach to the chroot isolation and do 
something similar to what the Yum payload and anaconda-yum already do.

Ales


More information about the anaconda-patches mailing list