Is there a way to check RPM signatures during a kickstart install?

dcellis1950 · 09-15-2010, 11:27 AM

Is there a way to check RPM signatures during a kickstart install? Seems as if the signatures are not checked during an installation.

unSpawn · 10-11-2010, 04:04 PM

Quote:

Originally Posted by dcellis1950

Is there a way to check RPM signatures during a kickstart install?

If the kickstart configuration file allows for a "%pre" section you could run custom commands there. However checking RPM signatures implies you have something to check against. Sounds more like an implementation rather than a Linux Security question to me.

dcellis1950 · 10-13-2010, 05:53 AM

Thank you for your response.

%pre doesn't seem to work. I think the reason is that the RPM database has not been created, so the gpg keys can't be imported, at the time %pre is run.

The only way I have found to do this is by modifying the kickstart and yum python scripts. Will post patches once I have it debugged it.

anomie · 10-13-2010, 01:57 PM

Quote:

Originally Posted by unSpawn

However checking RPM signatures implies you have something to check against.

One of the very first things he'd need to do is import the public key into rpm(8)'s consciousness to check signatures.

Quote:

Originally Posted by dcellis1950

%pre doesn't seem to work. I think the reason is that the RPM database has not been created, so the gpg keys can't be imported, at the time %pre is run.

Hmm, that surprises me. But I have not tested this. Where is kickstart pulling packages from? One idea is you could verify the package sigs prior to install time from another, working system. With some creativity you could even automate this (again using a process on another, working system).

dcellis1950 · 10-14-2010, 06:28 PM

I have been able to add a python method to the yum code. It imports all keys from the directory /etc/pki/rpm-gpg. This needs to be run between the creation of the RPM database and the start of installation. Still debugging and seeing if I can improve it.

The problem with %pre is that the RPM database has not been created yet and so keys can't be imported.

Thanks for the help.

dcellis1950 · 10-14-2010, 06:31 PM

As to this not being a security question, maybe, maybe not. But I feel installing unverified RPMS is a security problem.