Re: xz meltdown/Lasse Collin

On Sun, 2024-04-14 at 12:21 +0200, Vegard Nossum wrote:
> On 13/04/2024 15:16, James Bottomley wrote:
> >     2. We need better build artifact transparency generally but  I
> > think
> >        the kernel is fine here: we still use make so don't have the
> > huge
> >        build artifact issue that allowed the exploit in and we have
> > a
> >        documented signing process for our build artifacts (kernel
> >        tarballs).
> >     3. The indirect library dependency problem doesn't apply to us.
> 
> While this is technically true, there are many other ways to
> compromise the kernel build process:

#define injection and environmental injection have to be done on the
build system (I mean so did the xz payload injection but it found a
carrier in the autoconf files).  We're getting better at hermetic
builds and other things that make direct build system tampering more
difficult to pull off.  Hopefully, one day soon, we'll get to
reproduceable builds that someone outside the distro will be able to
check every distro binary ... and that would pick up almost any type of
build system injection attack.

James