<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On May 10, 2011, at 6:14 AM, Sridhar Dhanapalan wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><p>On 05/05/2011 9:58 AM, "Chris Ball" <<a href="mailto:cjb@laptop.org">cjb@laptop.org</a>> wrote:<br> > There's interest, but it's more complicated than you think. As I<br> > understand it, customization sticks can be signed and run in secure mode<br> > because they perform no side-effects outside of /home. However, an RPM<br> > can have a %post section which lists commands to be run *as root* during<br> > the installation.<br> ><br> > So, offering the ability to install RPMs via signed customization stick<br> > is equivalent to letting anyone run any series of commands as root.<br> ><br> > There may be ways to mitigate this risk, such as refusing to run any<br> > %post scripts (some of which are necessary for proper function of<br> > packages). Working out what the safe set of actions a hostile RPM<br> > can perform on a system is a research project, as far as I know.</p><p>Can we make it so that it only installs signed RPMs? Would that help?</p></blockquote>I signed manifest which includes a list of files would probably be more feasible as you wouldn't have to alter the RPMs.</div><div><br></div><div>Reuben</div><br></body></html>