7

Let’s say I install a package using dpkg:

sudo dpkg -i package-name.deb

then without running the package binaries I just remove it:

sudo dpkg -r package-name

Is there anything harmful that can happen in this process? For example, any malicious configuration script in the .deb file? What are other possible threats that might happen?

Improve this question
2
  • I even once wrote a small .rpm file called "timebomb" that didn't contain any files and no install script, but an uninstall script effectively doing rpm -rf /. I didn't dare to test it, however…
    – glglgl
    May 8, 2017 at 10:32
  • Seems that I should read the whole documentation about creating deb packages to make sure what else can be happen.
    – Ravexina
    May 8, 2017 at 10:38

2 Answers 2

Reset to default
24

Yes, packages can contain “maintainer scripts” which are run before and/or after installation. You can see the scripts, if any, by extracting the control archive from the package:

dpkg-deb --ctrl-tarfile package-name.deb > control.tar
tar tf control.tar

or, if you know you want to extract the control archive’s contents:

dpkg-deb -e package-name.deb package-control

(which places the extracted files in a directory named package-control).

They run as root and can do whatever the package author wants on your system.

You should really consider that installing a package is equivalent to granting the maintainer (and anyone else involved in the package’s maintenance and build) root access to your system. Who do you trust?

Improve this answer
6
  • Thanks, so if I examine the script and if there was nothing suspicious with that, I'm safe to go? actually there is only a control and md5sum file in control.tar.
    – Ravexina
    May 7, 2017 at 18:43
  • 1
    The scripts can be ok and you will have binaries running as root...as usual install only things from trusted sources.
    – Rui F Ribeiro
    May 7, 2017 at 18:44
  • I can't get it, so while installing using dpkg there might be other binaries involved in installation process from package? (lets say there is no pre or post install script in deb file). PS: package is from kde.org. I'm just really paranoia ;)
    – Ravexina
    May 7, 2017 at 18:57
  • 5
    @StephenKitt The package may install files in locations which are run automatically, such as /etc/cron.d (and many others).
    – user130738
    May 8, 2017 at 1:37
  • dpkg-deb --control to just extract the control archive directly
    – muru
    May 8, 2017 at 8:34
9

Even forgetting maintainer scripts, the package might install a Cron script that runs every minute, and the minute might tick over in-between you installing and uninstalling the package.

Or it might install a program at /bin/python for example (which will be used in preference to the real /usr/bin/python) and then some background process might try to launch Python.

Or it might install a program at /bin/dpkg so that when you try to remove it you're actually just running it.

Improve this answer
6
  • 1
    +1 for cron and dpkg. In Debian, packaged Python scripts specify #!/usr/bin/python or #!/usr/bin/python3 so their interpreter can’t be hijacked in the way you describe (but local scripts might use env and be vulnerable). A package could just replace Python though!
    – Stephen Kitt
    May 8, 2017 at 7:22
  • @StephenKitt I wasn't sure if a package could replace existing files, as that would make it difficult for dpkg to uninstall it correctly. Python scripts don't universally find Python through the shebang line - the calling program could also run python whatever.py.
    – user253751
    May 8, 2017 at 7:30
  • 1
    There are (at least) two ways for a package to replace existing files: it can declare a Replaces relationship in its control file, and then it’s allowed to replace any file in the replaced package, or it can divert a file (but then it needs maintainer scripts to do that). Agreed on python whatever.py, at least for locally-installed programs (I think that would go against Debian policy, so I wouldn’t expect Debian packages to do that).
    – Stephen Kitt
    May 8, 2017 at 7:58
  • What about a service like apache? Doesn't it start automatically right upon installation?
    – Calimo
    May 8, 2017 at 9:16
  • 1
    @Calimo That's probably a maintainer script
    – user253751
    May 8, 2017 at 9:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .