[PATCH 3/4] DNFpayload: disable all NSS operations in RPM.
Ales Kozumplik
akozumpl at redhat.com
Thu Sep 12 08:53:07 UTC 2013
On 09/11/2013 04:35 PM, Chris Lumens wrote:
>> Due to a serious problem with NSS and fork() the Payload will have to do without
>> crypto.
>>
>> Related:RhBug:1006280
>
> What are the practical consequences of this?
The phase where rpm checks the digest and signing of the package *during
transaction* is skipped. But DNF checks digests of any package
downloaded from a repo already. The only thing we are losing
security-wise is if somebody managed to get a spoofed package into the
repo and then get the metadata to be generated against that. Which is
hard to imagine to be happening for Fedora and if it can happen at a
third party repo then they can also sign the package properly.
We are gaining some performance (computing the hashes is not for free)
and of course we avoid the SIGSEGVs in RPM.
In theory, once the Payload is in wide use, someone with a reasonable
security background might come and explain and complain. Then there's
two options:
1) 1006280 will get fixed and I'll reenable the crypto in RPM.
2) In case the maintainers refuse to fix 1006280 ('keep up being
unhelpful' is how some people might put it) the DNF Payload will have to
drop the multiprocessing approach to the chroot isolation and do
something similar to what the Yum payload and anaconda-yum already do.
Ales
More information about the anaconda-patches
mailing list