On 8/2/26 10:02 AM, Ralf Mardorf wrote:
I do build some packages in a clean chroot environment, and even though
I’m very familiar with systemd-nspawn for other reasons, I never use it
to build packages. But all of that sidesteps my actual question: why can
`sudo` be executed at all during the build process (not during
installation) which, if I understood correctly, was the issue with the
last attack, without the user being prompted for a password, and how can
this be prevented?
René's link [1] is the way I've gone to building everything, stretching
back before the May onslaught.
I too am very confused on the sudo issue. Meaning, that unless the user
has modified /etc/sudoers via visudo and set to allow all with no
password, any sudo call should trigger a password prompt with the
default config -- was/is that not happening with the poisoned packages
in this latest round?
Aside from the fact that the latest attack is also frustrating because
you simply don’t want junk in PKGBUILDs, I’d like to understand whether
you shouldn’t actually be suspicious during the build process, even if
you’re building as a user without a container-based approach, since you
should be prompted to enter a password. Or are you not prompted to do
so, and if so, why, and if so, wouldn’t deleting the sudo timestamp or
something else prevent this?
I’d like to understand the latest attack. Fortunately, there are no
PKGBUILDs in the AUR that I could look at.
I've been following along, but I'm still not sure what form the binary
takes or where in the build process it is attempted to be slipped in.
Probably the most descriptive e-mail thus far has been "New spam /
take-over malware wave - info collection & questions" which provided
some good information (thanks to archlists at lenucksi.eu), but I don't
see any follow-up on the questions posed.
Thank you Claudia and Robin for your timely effort and replies to the
various threads on the lists. If there is any pertinent information you
can share about what we should be looking for as far as the sudo issue
goes, that would be welcomed.
Even an example PKGBUILD line where it is invoked, or whether/how it is
being injected in the build would help clarify and provided the ability
for the rest of us to ensure we protect against the current binary
malware approach.
Thank you all again for the information and your efforts.
[1]
https://wiki.archlinux.org/title/DeveloperWiki:Building_in_a_clean_chroot
--
David C. Rankin, J.D.,P.E.
