freebsd security - Jan 2020 - Cryptographic signatures of installer sets

On Sat, Jan 25, 2020 at 08:00:07PM +0000, Nathan Dorfman
wrote:
> Hello all,
> 
> I really hope I'm missing something here, and we can all have a nice
> chuckle at my expense.
> 
> But I can't see any way the integrity of the installer sets (base.txz,
> kernel.txz and friends) can be verified cryptographically? There is a
> MANIFEST file containing SHA256 checksums, but it itself does not appear
> to be signed in any way.
> 
> The installer images do come with PGP-signed checksums. So, when using
> an image that already contains all the sets, one can be sure they are
> authentic. What happens when one uses a network-only installer, though?
> How can it authenticate the sets it downloads from the user's chosen
> mirror?
> 
> A cursory glance at src/usr.sbin/bsdinstall suggests that it does not,
> in fact, do that. Checksums are compared against the MANIFEST (in
> scripts/checksum), but that is itself simply downloaded from the same
> mirror (in scripts/jail), usually over plain FTP, without any
> authentication.
> 
No, this last part is not true.  The installer always verifies the
checksums against /usr/freebsd-dist/MANIFEST on the installation medium.

In particular, this was done in r293223, where the LOCAL_DISTRIBUTIONS
variable explicitly contains the MANIFEST.

Glen

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL:
<http://lists.freebsd.org/pipermail/freebsd-security/attachments/20200127/1224bc48/attachment.sig>

On Mon, Jan 27, 2020 at 04:42:01PM +0000, Glen Barber
wrote:
> No, this last part is not true.  The installer always verifies the
> checksums against /usr/freebsd-dist/MANIFEST on the installation medium.
> 
> In particular, this was done in r293223, where the LOCAL_DISTRIBUTIONS
> variable explicitly contains the MANIFEST.
Thank you, Glen. You're correct of course; the installer uses its
embedded MANIFEST and doesn't even fetch it from the mirror... during
system installation, at least.

However, the first time a jail is set up, using the `bsdinstall jail`
command, it does in fact fetch and trust the mirror's MANIFEST. I just
tested this with a freshly installed 12.1-RELEASE system and a local
mirror with a modified base.txz and manifest. It installs the modified
files into the new jail without any complaint.

Simply, after a clean installation /usr/freebsd-dist doesn't exist on
the new system, so the jail script creates it and downloads the MANIFEST
from the mirror. See lines 60-70, here:

https://svnweb.freebsd.org/base/release/12.1.0/usr.sbin/bsdinstall/scripts/jail?view=markup#l60

After the first jail, this downloaded manifest and package(s) are saved
in /usr/freebsd-dist. So you are only at risk the first time, and there
will be some evidence of the tampering. Still, I hope you'll agree that
this should be fixed. The installer already has a trusted manifest as
you point out, why not simply install that one into the target system's
/usr/freebsd-dist at setup time?

-nd.