12

I just came across something that I wonder could possibly be a major security issue with the Linux terminal. I was trying to install g++ 5.0. I'm a newbie to Linux, so I just typed sudo apt-get install g++ 5.0. Instead of just returning an error or something, it installed Virtual Box!

If I try to install one thing from the terminal and it install something completely different, does that mean it could happen to something else, possibly malware? Why would it install Virtual Box when I typed something completely different, anyway?

  • 6
    ... AFAIK apt-get will ask confirmation from the user, so you could just insert n and avoid installing VirtualBox... Also Ubuntu's repository are checked, so there shouldn't be any malware package that you can install in the first place. If you add random PPAs this might happen but that's because you told Ubuntu to install applications from an untrusted source. – Bakuriu Aug 1 '16 at 8:33
  • 1
    Fav'd (and +1'ed of course) because this question really deserves it. It shows the (irreversible) bad effects of not caring enough for your actions, and is a motivation for you to not do the same, careless mistake. – EKons Aug 1 '16 at 9:29
  • 12
    a major security issue with the Linux terminal No, calm down. This was just (no offence!) you not reading/typing properly - not any problem with Linux, apt-get, or any of the many different terminals that are available. – underscore_d Aug 1 '16 at 10:56
  • 2
    @ΈρικΚωνσταντόπουλος What are the "irreversible bad effect"? Installing a non-malware program that you can as easily uninstall? – Bakuriu Aug 1 '16 at 14:12
  • 2
    Wait until you discover "rm -rf directoryA/ directoryB /" (don't try it!). You have to be careful what you type and paste as root. – pjc50 Aug 1 '16 at 15:12
29

The command

sudo apt-get install g++ 5.0 

indicates you want to install two packages: g++ and 5.0. (Package names don't have spaces, and apt-get accepts multiple package names, separated by spaces.)

What probably happened is that it installed g++ as requested, then installed all packages (including version numbers) that match the regular expression 5.0 (since there's no package actually named 5.0). (thanks @edwinksl!)

To avoid this, make sure you have the correct package names, without spaces. You can also use the -s option to simulate an apt-get action before doing it for real:

sudo apt-get -s install g++ 5.0

will show you the actions that the command would perform, without actually installing anything. If it looks OK, you can remove the -s to perform the installation.

You could also consider using a more newbie-friendly graphical package manager, such as synaptic or muon.

  • 4
    5.0 is being used as a regex, so apt is doing more than just matching the string "5.0". – edwinksl Jul 31 '16 at 23:56
  • 10
    For the people who are not familiar with regex, a dot matches any single character. And since a regex match by default looks anywhere in a string, "5.0" means "any name which contains a 5, followed 2 characters later by a 0". Examples "FooBar 2.510" or "AcmeWidgets 5.0" ("any single character" does include a literal dot) – MSalters Aug 1 '16 at 10:05
8

The correct command to install g++ version 5.x is:

sudo apt-get install g++-5

This will install g++ version 5.3 on xenial, which is the current default (so apt-get install g++ installs it as well, but this will change in the future). In fact, there is no public 5.0 release of GCC. Other g++ releases are packaged, e.g. g++-4.9 or g++-6, which can be installed in the same way.

If you ever need to install a specific (existing) release of g++ which is not packaged for your system, you'll have to build it from sources.

  • 2
    This is a good point; sudo apt install g++5.0 (without the space between g++ and 5.0) would still have failed. – edwinksl Aug 1 '16 at 11:06
4

Let's break it down.

First of all, few notes on how apt-get install (and most other apt-get arguments too) works:

  • You can input multiple package names:

    sudo apt-get install foobar spamegg 
    
  • The package names are actually Extended Regular Expression (ERE) (Check man 7 regex) patterns so a package name foo.bar means any package name that has a substring that starts with foo and ends with bar with any single character between foo and bar. Likely f.*r means any package name that contains a substring that has f and r with any number of characters i.e. anything in between. To do the whole package name matching, use start and end tokens e.g. ^foo.bar$. If you want any Regex token to be treat literally then you need to escape the token with \ e.g. for treating foo.bar literally, you need:

    sudo apt-get install 'foo\.bar'
    

    Here the single quoting is to prevent shell interpretation of the pattern as a globbing pattern, not necessary in this case but would be needed e.g. for pattern foo.*bar if you have a file in the current directory named e.g. foo.bar.

  • There is a catch on the package name consideration. If there is any package matching the pattern, the pattern will be treated literally and no Regex interpretation will be done. For example, for a package pattern g++, it will match the package g++ literally irrespective of the Regex token +. If there were no package named g++ in the defined repositories, it will be treated as a ERE pattern.

Now, you have given the command:

sudo apt-get install g++ 5.0

This means:

  • You want to install two patterns provided packages namely g++ and 5.0

  • g++ matches the literal meta-package g++ as mentioned above

  • The remaining portion, 5.0, has a Regex token, . i.e. any single character. So this will match any package name that contains 5<any_character>0. So all the packages that have the match has been selected to be installed and presumably virtualbox-5.0 has also been selected in the process.

Presumably you want to install g++ version 5, so doing the following would do(already mentioned in this answer); The meta-package, g++-5, will refer to the latest available minor released package of g++ version 5:

sudo apt-get install g++-5

To search for any packages, within the configured repositories, use apt-cache (uses ERE like apt-get):

apt-cache search 'g\+\+-[0-9]+'

If you do not want to Regex-ify it, use less to scroll down the rather larger list:

apt-cache search g++ | less

Also before installing anything you are not sure about, do not use -y (--assume-yes) option and test it first with -s (--simulate/--dry-run):

sudo apt-get install --dry-run foobar
  • 1
    +1 Most complete and organized answer. Trying literal matches before falling back on REs; the use of extended RE (as opposed to plain REs); the ability to apt-cache search are all important to be aware of. – arielf Aug 5 '16 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy