Let’s say I install a package using dpkg:

sudo dpkg -i package-name.deb

then without running the package binaries I just remove it:

sudo dpkg -r package-name

Is there anything harmful that can happen in this process? For example, any malicious configuration script in the .deb file? What are other possible threats that might happen?

  • I even once wrote a small .rpm file called "timebomb" that didn't contain any files and no install script, but an uninstall script effectively doing rpm -rf /. I didn't dare to test it, however… – glglgl May 8 '17 at 10:32
  • Seems that I should read the whole documentation about creating deb packages to make sure what else can be happen. – Ravexina May 8 '17 at 10:38

Yes, packages can contain “maintainer scripts” which are run before and/or after installation. You can see the scripts, if any, by extracting the control archive from the package:

dpkg-deb --ctrl-tarfile package-name.deb > control.tar
tar tf control.tar

or, if you know you want to extract the control archive’s contents:

dpkg-deb -e package-name.deb package-control

(which places the extracted files in a directory named package-control).

They run as root and can do whatever the package author wants on your system.

You should really consider that installing a package is equivalent to granting the maintainer (and anyone else involved in the package’s maintenance and build) root access to your system. Who do you trust?

  • Thanks, so if I examine the script and if there was nothing suspicious with that, I'm safe to go? actually there is only a control and md5sum file in control.tar. – Ravexina May 7 '17 at 18:43
  • 1
    The scripts can be ok and you will have binaries running as root...as usual install only things from trusted sources. – Rui F Ribeiro May 7 '17 at 18:44
  • I can't get it, so while installing using dpkg there might be other binaries involved in installation process from package? (lets say there is no pre or post install script in deb file). PS: package is from kde.org. I'm just really paranoia ;) – Ravexina May 7 '17 at 18:57
  • 5
    @StephenKitt The package may install files in locations which are run automatically, such as /etc/cron.d (and many others). – duskwuff May 8 '17 at 1:37
  • dpkg-deb --control to just extract the control archive directly – muru May 8 '17 at 8:34

Even forgetting maintainer scripts, the package might install a Cron script that runs every minute, and the minute might tick over in-between you installing and uninstalling the package.

Or it might install a program at /bin/python for example (which will be used in preference to the real /usr/bin/python) and then some background process might try to launch Python.

Or it might install a program at /bin/dpkg so that when you try to remove it you're actually just running it.

  • 1
    +1 for cron and dpkg. In Debian, packaged Python scripts specify #!/usr/bin/python or #!/usr/bin/python3 so their interpreter can’t be hijacked in the way you describe (but local scripts might use env and be vulnerable). A package could just replace Python though! – Stephen Kitt May 8 '17 at 7:22
  • @StephenKitt I wasn't sure if a package could replace existing files, as that would make it difficult for dpkg to uninstall it correctly. Python scripts don't universally find Python through the shebang line - the calling program could also run python whatever.py. – immibis May 8 '17 at 7:30
  • 1
    There are (at least) two ways for a package to replace existing files: it can declare a Replaces relationship in its control file, and then it’s allowed to replace any file in the replaced package, or it can divert a file (but then it needs maintainer scripts to do that). Agreed on python whatever.py, at least for locally-installed programs (I think that would go against Debian policy, so I wouldn’t expect Debian packages to do that). – Stephen Kitt May 8 '17 at 7:58
  • What about a service like apache? Doesn't it start automatically right upon installation? – Calimo May 8 '17 at 9:16
  • 1
    @Calimo That's probably a maintainer script – immibis May 8 '17 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.