Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[SOLVED] possible compromised distfile
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
xanderal
Tux's lil' helper
Tux's lil' helper


Joined: 06 Mar 2019
Posts: 129
Location: Germany

PostPosted: Sun Jun 23, 2019 7:42 pm    Post subject: [SOLVED] possible compromised distfile Reply with quote

Hi,
as far as I understand the source code lives in DISTDIR (as set in make.conf), right?
So it shouldn't be a problem to delete a file in there of something I already installed?
Problem is that clamav flags one of them as problematic but a lot of packages depend on the (possibly compromised) package...


Last edited by xanderal on Fri Jul 19, 2019 8:01 am; edited 1 time in total
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 7440
Location: almost Mile High in the USA

PostPosted: Sun Jun 23, 2019 8:22 pm    Post subject: Reply with quote

DISTDIR is a download directory where portage stores files and extracts them on build. Files there are checked by the checksums stored in the portage tree. The portage tree is now signed. So you do have implicit protection from corruption in DISTDIR. You can safely remove files from there - portage will automatically redownload files stored there as needed. A took called "eclean" in app-portage/gentoolkit cam be used to clean up old files.

Clamav is a special case. A default set of signature files can be downloaded/used from the distribution, but freshclam can download new signature files outside of portage, and now portage does not know if the files were corrupted or not post installation - it assumes so because they no longer match what they were initially installed with.

However freshclam should not be downloading to DISTDIR...what is the exact error and what program is reporting the corruption?
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
xanderal
Tux's lil' helper
Tux's lil' helper


Joined: 06 Mar 2019
Posts: 129
Location: Germany

PostPosted: Sun Jun 23, 2019 8:42 pm    Post subject: Reply with quote

eccerr0r wrote:
DISTDIR is a download directory where portage stores files and extracts them on build. Files there are checked by the checksums stored in the portage tree. The portage tree is now signed. So you do have implicit protection from corruption in DISTDIR. You can safely remove files from there - portage will automatically redownload files stored there as needed. A took called "eclean" in app-portage/gentoolkit cam be used to clean up old files.

That was what I was hoping for - thanks for the explanation.
eccerr0r wrote:
Clamav is a special case. A default set of signature files can be downloaded/used from the distribution, but freshclam can download new signature files outside of portage, and now portage does not know if the files were corrupted or not post installation - it assumes so because they no longer match what they were initially installed with.

However freshclam should not be downloading to DISTDIR...what is the exact error and what program is reporting the corruption?

As far as I can tell freshclam didn't download to DISTDIR. I just scanned / recursively and clamav complained about gdk-pixbuf and emerge -pv --depclean gdk-pixbuf shows that it is being pulled in by about 20 packages. That's why I wanted to start by removing the distfile and not by unmerging gdk-pixbuf.
Back to top
View user's profile Send private message
Jaglover
Watchman
Watchman


Joined: 29 May 2005
Posts: 7653
Location: Saint Amant, Acadiana

PostPosted: Sun Jun 23, 2019 8:44 pm    Post subject: Reply with quote

Probably false positive. I doubt your distfile(s) are actually compromised.
_________________
Please learn how to denote units correctly!
Back to top
View user's profile Send private message
xanderal
Tux's lil' helper
Tux's lil' helper


Joined: 06 Mar 2019
Posts: 129
Location: Germany

PostPosted: Sun Jun 23, 2019 8:49 pm    Post subject: Reply with quote

Jaglover wrote:
Probably false positive. I doubt your distfile(s) are actually compromised.

You might be right. What I can say is that I reinstalled gentoo a couple of days ago (for unrelated reasons) and clamav flagged that file on the earlier gentoo install, too.
So, if you're right, clamav has had this false positive for at least a couple of weeks (yes, I didn't react all that fast...)
Back to top
View user's profile Send private message
Ant P.
Watchman
Watchman


Joined: 18 Apr 2009
Posts: 6480

PostPosted: Mon Jun 24, 2019 3:33 am    Post subject: Reply with quote

ClamAV is detecting a GIF testcase for a fix for the exploit it was supposed to be protecting from.

This antivirus software is worse than useless… if it were taken as truth, you would now be running software vulnerable to that malware. And would most likely be completely unprotected: who scans every image they encounter on the internet before viewing it?
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 7440
Location: almost Mile High in the USA

PostPosted: Mon Jun 24, 2019 3:52 am    Post subject: Reply with quote

Ant P. wrote:
who scans every image they encounter on the internet before viewing it?

And that's why McAfee is so slow...
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
xanderal
Tux's lil' helper
Tux's lil' helper


Joined: 06 Mar 2019
Posts: 129
Location: Germany

PostPosted: Fri Jul 19, 2019 8:01 am    Post subject: Reply with quote

eccerr0r wrote:
You can safely remove files from there - portage will automatically redownload files stored there as needed

Thanks. I deleted the file and everything is good now ;)
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum