how to 'rip apart' a rpm.

[Todd Zullinger]

Genes MailLists wrote:
> Whilst I agree we should be as careful w root as possible - if
> someone is willing to install a binary rpm as root - how is that
> more secure than building the source to the same package?

One of the main concerns I have with building is broken Makefiles.
Say you're rebuilding a package from Fedora and updating it to a newer
upstream version.  It could happen that upstream has changed their
Makefiles (or more likely, the automake files used to generate the
Makefiles).  If something like DESTDIR gets forgotten, you could end
up removing or overwriting system files during the build.

Once the package is built, you can inspect the binary rpm to see what
files it provides, and if it tries to provide files that are already
provided by a different package, rpm will complain loudly about the
conflicts when you try to install it.

And yeah, the concerns are greater for non-fedora packages which may
not have had the benefit of a decent review (though not all Fedora
packages get that either).

In general, it's just a matter of best practice to build as a non-root
user.  Ideally, you don't want to build as your normal user either, to
prevent files like your ssh or gpg keys or other sensitive files from
being exposed to a potentially buggy and/or malicious build
environment.

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
There is considerable overlap between the intelligence of the smartest
bears and the dumbest tourists.
  -- Park ranger yro.slashdot.org/comments.pl?sid=191810&cid=15757347

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 542 bytes
Desc: not available
Url : http://lists.fedoraproject.org/pipermail/users/attachments/20100516/2a13145e/attachment.bin