Suspicious behavior of packagekit

[S.Mohammad Emami Razavi]

I run
$ [root@localhost rooster]# journalctl -u packagekit -f -n 5000
in fedora
[root@localhost rooster]# cat /etc/redhat-release
Fedora release 22 (Twenty Two)
and it results something like below lines:
Jul 21 06:54:28 localhost.localdomain PackageKit[18871]: uid 1000 is trying
to obtain org.freedesktop.packagekit.system-sources-refresh auth
(only_trusted:0)
Jul 21 06:54:28 localhost.localdomain PackageKit[18871]: uid 1000 obtained
auth for org.freedesktop.packagekit.system-sources-refresh
Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: refresh-cache
transaction /345_edadcabc from uid 1000 finished with success after
2536929ms
Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: get-updates
transaction /346_aaeccddc from uid 1000 finished with success after 555ms
Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: new
update-packages transaction /347_eacacecc scheduled from uid 1000
Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: update-packages
transaction /347_eacacecc from uid 1000 finished with cancelled-priority
after 2594ms
Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve
transaction /348_caabddad from uid 1000 finished with success after 143ms
Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve
transaction /349_aabcaabc from uid 1000 finished with success after 83ms
Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve
transaction /350_dbadaaeb from uid 1000 finished with success after 31ms
Jul 21 07:36:50 localhost.localdomain PackageKit[18871]: new
update-packages transaction /351_bebbaccb scheduled from uid 1000
Jul 21 09:27:31 localhost.localdomain PackageKit[18871]: update-packages
transaction /351_bebbaccb from uid 1000 finished with success after
6640574ms
Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve
transaction /352_cababcaa from uid 1000 finished with success after 30ms
Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve
transaction /353_ccabcecc from uid 1000 finished with success after 81ms
Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve
transaction /354_caddccdb from uid 1000 finished with success after 30ms
Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve
transaction /355_ddaacaea from uid 1000 finished with success after 278ms
Jul 21 09:27:37 localhost.localdomain PackageKit[18871]: get-update-detail
transaction /356_dabbaeed from uid 1000 finished with success after 1611ms


It has very suspicious and unusual behavior to use network bandwidth. For
example in 10 days it downloads over 2GB from net!!! regardless of dnf or
yum updates...

[Lee Fuller]

Are you sure this behaviour isn't simply a package metadata refresh?

(Second send - didn't "reply all" at first try)

Regards
On 24 Jul 2015 2:22 pm, "S.Mohammad Emami Razavi" <emamirazavi(a)gmail.com&gt;
wrote:

>  I run
>  $ [root@localhost rooster]# journalctl -u packagekit -f -n 5000
>  in fedora
>  [root@localhost rooster]# cat /etc/redhat-release
>  Fedora release 22 (Twenty Two)
>  and it results something like below lines:
>  Jul 21 06:54:28 localhost.localdomain PackageKit[18871]: uid 1000 is
>  trying to obtain org.freedesktop.packagekit.system-sources-refresh auth
>  (only_trusted:0)
>  Jul 21 06:54:28 localhost.localdomain PackageKit[18871]: uid 1000 obtained
>  auth for org.freedesktop.packagekit.system-sources-refresh
>  Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: refresh-cache
>  transaction /345_edadcabc from uid 1000 finished with success after
>  2536929ms
>  Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: get-updates
>  transaction /346_aaeccddc from uid 1000 finished with success after 555ms
>  Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: new
>  update-packages transaction /347_eacacecc scheduled from uid 1000
>  Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: update-packages
>  transaction /347_eacacecc from uid 1000 finished with cancelled-priority
>  after 2594ms
>  Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve
>  transaction /348_caabddad from uid 1000 finished with success after 143ms
>  Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve
>  transaction /349_aabcaabc from uid 1000 finished with success after 83ms
>  Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve
>  transaction /350_dbadaaeb from uid 1000 finished with success after 31ms
>  Jul 21 07:36:50 localhost.localdomain PackageKit[18871]: new
>  update-packages transaction /351_bebbaccb scheduled from uid 1000
>  Jul 21 09:27:31 localhost.localdomain PackageKit[18871]: update-packages
>  transaction /351_bebbaccb from uid 1000 finished with success after
>  6640574ms
>  Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve
>  transaction /352_cababcaa from uid 1000 finished with success after 30ms
>  Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve
>  transaction /353_ccabcecc from uid 1000 finished with success after 81ms
>  Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve
>  transaction /354_caddccdb from uid 1000 finished with success after 30ms
>  Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve
>  transaction /355_ddaacaea from uid 1000 finished with success after 278ms
>  Jul 21 09:27:37 localhost.localdomain PackageKit[18871]: get-update-detail
>  transaction /356_dabbaeed from uid 1000 finished with success after 1611ms
>
>
>  It has very suspicious and unusual behavior to use network bandwidth. For
>  example in 10 days it downloads over 2GB from net!!! regardless of dnf or
>  yum updates...
>
>
>  --
>  security mailing list
>  security(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/security
>

[Chris Murphy]

On Fri, Jul 24, 2015 at 7:22 AM, S.Mohammad Emami Razavi
<emamirazavi(a)gmail.com&gt; wrote:
>  I run
>  $ [root@localhost rooster]# journalctl -u packagekit -f -n 5000
>  in fedora
>  [root@localhost rooster]# cat /etc/redhat-release
>  Fedora release 22 (Twenty Two)
>  and it results something like below lines:
>  Jul 21 06:54:28 localhost.localdomain PackageKit[18871]: uid 1000 is trying
>  to obtain org.freedesktop.packagekit.system-sources-refresh auth
>  (only_trusted:0)
>  Jul 21 06:54:28 localhost.localdomain PackageKit[18871]: uid 1000 obtained
>  auth for org.freedesktop.packagekit.system-sources-refresh
>  Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: refresh-cache
>  transaction /345_edadcabc from uid 1000 finished with success after
>  2536929ms
>  Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: get-updates
>  transaction /346_aaeccddc from uid 1000 finished with success after 555ms
>  Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: new update-packages
>  transaction /347_eacacecc scheduled from uid 1000
>  Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: update-packages
>  transaction /347_eacacecc from uid 1000 finished with cancelled-priority
>  after 2594ms
>  Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve transaction
>  /348_caabddad from uid 1000 finished with success after 143ms
>  Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve transaction
>  /349_aabcaabc from uid 1000 finished with success after 83ms
>  Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve transaction
>  /350_dbadaaeb from uid 1000 finished with success after 31ms
>  Jul 21 07:36:50 localhost.localdomain PackageKit[18871]: new update-packages
>  transaction /351_bebbaccb scheduled from uid 1000
>  Jul 21 09:27:31 localhost.localdomain PackageKit[18871]: update-packages
>  transaction /351_bebbaccb from uid 1000 finished with success after
>  6640574ms
>  Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve transaction
>  /352_cababcaa from uid 1000 finished with success after 30ms
>  Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve transaction
>  /353_ccabcecc from uid 1000 finished with success after 81ms
>  Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve transaction
>  /354_caddccdb from uid 1000 finished with success after 30ms
>  Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve transaction
>  /355_ddaacaea from uid 1000 finished with success after 278ms
>  Jul 21 09:27:37 localhost.localdomain PackageKit[18871]: get-update-detail
>  transaction /356_dabbaeed from uid 1000 finished with success after 1611ms
>
>
>  It has very suspicious and unusual behavior to use network bandwidth. For
>  example in 10 days it downloads over 2GB from net!!! regardless of dnf or
>  yum updates... 
This doesn't sound like a security related problem though. Try:

gsettings set org.gnome.software download-updates false

And then you can just manually check in GNOME Software for updates, or use dnf.



-- 
Chris Murphy