0

As part of a prototype arch linux image generation script (which can be seen for code review here), I use the normal pacstrap utility to populate a file-system with a bootable install and additional packages.

What information about the host is used for this / included in the new file-system install?

My primary concern is in inadvertently releasing security or identifiable information when I upload or distribute a generated file-system image.

My secondary concern is that the file-system image is in some way tailored to my hardware (beyond 64bit amd/intel) and so would be unable to boot or operate normally on other equipment.

0

Based upon examining both a minimal test image generated that uses pacstrap and looking at the pacstrap help, at least the following information seems to be moved onto the new system:

  • package repository lists and their identity authentication.
  • you pacman keyring (which is a web of trust style authentication.

Both of these can at least leak some identification information and the keyring could include your identity depending on your previous activity.

If you have a private/organisational package repository that is either a local mirror to speed up operations / reduce internet traffic or contains 'approved' packages then you mirror list provides internal networking details.

Your pacman keyring could either contain a link to your GnuPG public key or someone else's from your organisation for packages that are unique to you / your company. Allowing access to and analysis of your key ring can allow an attacker to find uncommon keys as a likely originator identification of the image.

Most of this probably only matters for organisations that have a policy of attack mitigation (reduce the amount of unnecessary information irrespective of apparent risk as a simple risk reduction measure since it is hard to predict with accuracy what might become important).

The pacman help provides you with a way to not move these over:

$ pacstrap -h
usage: pacstrap [options] root [packages...]

  Options:
    -C config      Use an alternate config file for pacman
    -c             Use the package cache on the host, rather than the target
    -G             Avoid copying the host's pacman keyring to the target
    -i             Avoid auto-confirmation of package selections
    -M             Avoid copying the host's mirrorlist to the target

    -h             Print this help message

pacstrap installs packages to the specified new root directory. If no packages
are given, pacstrap defaults to the "base" group.

So the -G and -M options will prevent copying over this information, however you will have to re-populate these on the new installation. A new keyring can be generate using:

pacman-key --init && pacman-key --populate archlinux

An 'appropriate' mirror list (whatever that means for a given situation) can be prepared and placed at /etc/pacman.d/mirrorlist

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.