How is it ensured that a trusted user can't compile a package with malware and place it in the universe repo.


NOTE: This is answered more in-depth by a member of Ubuntu Security Team in this answer. My answer below was written two years prior to the linked answer.

Canonical has Ubuntu Security Team, which is a paid group, that professionally reviews and supports software submitted to Ubuntu archives, as well as releasing fixes (aka the security updates) .

From the Ubuntu Wiki:

The Ubuntu Security Team often performs audits on software before it is to be officially supported. Once vulnerabilities are found, the Security Team uses responsible disclosure to let others know about the issue.

The Ubuntu Security Team doesn't work on the packages alone but does collaborate with others, in particular Debian security team, and vulnerability trackers such as MITRE CVE database , and maintains its own CVE Tracker.

The same wiki page also lists that they're actively involved in development of tools to protect form new vulnerabilities; among others , the tools are AppArmor, CompilerFlags, etc.

In particular, Security Team FAQ states:

Software installation tools that come bundled with Ubuntu, such as the Ubuntu Software Centre and Update Manager, validate packages when they are installed to make sure they are secure and have not been manipulated or trojaned during their download. Also, a large subset of packages in the archive are officially supported by the Ubuntu Security Team and get timely updates for security issues that may arise

So in other words put by thomasrutter , the packages are signed cryptographically to ensure their validation.

The specific repositories that Security team oversees are stated in the FAQ as well:

All binary packages in main and restricted are supported by the Ubuntu Security team for the life of an Ubuntu release, while binary packages in universe and multiverse are supported by the Ubuntu community.

Of course, software nowadays runs in millions and millions of lines of code, in variety of languages, so as our esteemed moderator ThomasW. noted properly , the security team are humans too, and they can't possibly keep track of everything. So yes, some vulnerabilities and bugs can slip through , especially in universe and multiverse repositories , but there are people and mechanisms in place to ensure that those vulnerabilities and bugs don't run rampant .

| improve this answer | |
  • 1
    @user Although there's no official statement on that, I would say yes - you want to use repositories that are actively supported, while universe packages may be unmaintained for long time. Server security is a very broad topic, though, there's no single solution. – Sergiy Kolodyazhnyy Jul 7 '16 at 1:18
  • 1
    On a side note, it's recommended to avoid X11 and gui apps for servers : askubuntu.com/a/159607/295286 Also , consider avoiding PPAs askubuntu.com/a/7667/295286 – Sergiy Kolodyazhnyy Jul 7 '16 at 1:27
  • 1
    @user The concept of caveat emptor applies for every time you install software. There's a lot of software that is in Universe that are very good and not malware. Compared to that, there's very little observed malware in the repositories from my observations. Blindly restricting yourself to main will block a lot of useful software. That said, servers should avoid GUIs, PPAs that aren't widely vetted by the community should also be avoided (PPAs are where caveat emptor really applies). I personally advise to not just "blindly block repository pockets" ... – Thomas Ward Jul 7 '16 at 1:30
  • 1
    ... but that's just my opinion as a server administrator, not as a moderator on the site. (I only install from trusted sources, and I don't blindly install software without doing a bit of research on it) – Thomas Ward Jul 7 '16 at 1:30
  • 1
    @waltinator well, yeah, that can be done, but OP mainly is interested in how Canonical takes care of security on their end. Which is what my answer addressed somewhat – Sergiy Kolodyazhnyy Jul 7 '16 at 2:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.