[gentoo-user] xz-backdoor followup / restrict high entropy files in ebuilds

[gentoo-user] xz-backdoor followup / restrict high entropy files in ebuilds

[Andreas Marx]

Hi all,

the xz-backdoor (CVE-2024-3094) luckily did not target gentoo, but it could have easily done so. One step in this sophisticated attack involved injecting concealed code into the build-process by some kind of homebrew steganography.

I asked myself how many high-entropy files I can find in distfiles. All these gif|png|jpg|jpeg|wav|der|xz|gz|p12 might actually be low entropy, but checking this would require a more sophisticated approach — in a naive approach, I just checked how much bzip2 is able to compress files.

But I also found some really unnecessary and — IMHO — high risk stuff in distfiles. tpm-tools f.e. has the /.git/ subdir with all those blobs. Python has some audio-testfiles.

In an ideal world, upstream would instead include some low entropy generators for this stuff. Gentoo should address the problem even if upstream is not responsive. 

I wonder if we should have some functionality in eclasses to
a) let src_unpack() filter/drop distfile content, controlled by an ebuild-variable (to deal f.e. with /.git/)
b) let src_unpack() warn on high entropy content (except files whitelisted in ebuild)
This would at least allow to easily identify high risk stuff that warrants more scrutiny.

  
Greets,
Andreas

BTW, this is my naive test script, sort output on -r -k3

#!/bin/bash

TMPDIR=/tmp/distfiles-entropy.$(date +"%Y%m%d%H%M%S")
trap ' rm -rf ${TMPDIR} ' EXIT
mkdir ${TMPDIR}
cd ${TMPDIR}

for DISTFILE in $(find /var/cache/distfiles/ -type f -printf '%f\n')
do
	mkdir ${DISTFILE}
	case ${DISTFILE} in
		*.tar.gz)	gzip -dc /var/cache/distfiles/${DISTFILE} | tar -C ${TMPDIR}/${DISTFILE} -xf -;;
		*.tgz)		gzip -dc /var/cache/distfiles/${DISTFILE} | tar -C ${TMPDIR}/${DISTFILE} -xf -;;
		*.tar.xz)	xzcat    /var/cache/distfiles/${DISTFILE} | tar -C ${TMPDIR}/${DISTFILE} -xf -;;
		*.txz)		xzcat    /var/cache/distfiles/${DISTFILE} | tar -C ${TMPDIR}/${DISTFILE} -xf -;;
		*.tar.bz2)	bzcat    /var/cache/distfiles/${DISTFILE} | tar -C ${TMPDIR}/${DISTFILE} -xf -;;
		*.tbz)		bzcat    /var/cache/distfiles/${DISTFILE} | tar -C ${TMPDIR}/${DISTFILE} -xf -;;
		*.gz)		gzip -dc /var/cache/distfiles/${DISTFILE} >        ${TMPDIR}/${DISTFILE}/file;;
		*)		cat      /var/cache/distfiles/${DISTFILE} >        ${TMPDIR}/${DISTFILE}/file;;
	esac
	find ${DISTFILE} -type f | xargs bzip2 -cv 2>&1 >/dev/null
	rm -rf ${TMPDIR}/${DISTFILE}
done