I installed elementary OS Juno on an old iMac 5,1. The Computer uses a 32bit EFI, which is not able to boot elementary OS Juno so I decided to follow Matt Gadients guide for a little workaround. You can find the workaround here: https://mattgadient.com/2016/07/11/linux-dvd-images-and-how-to-for-32-bit-efi-macs-late-2006-models/

I am wondering if this modified distro is still safe to use?

Matt Gadient describes how to modify the isos with a little C program to make them bootable on an 32bit EFI Mac. I did not download the isos from that site, instead I just downloaded the c program from Matt's site, which you can find as a text here: https://dedicated.mattgadient.com/linux-mac-iso/isomacprog.c.txt

I compiled the c programm with cc -g -Wall isomacprog.c -o isomacprog and modified the offical elementary OS Juno distro with it by doing something like ./isomacprog elementaryOSJuno.iso Bytw: the modified iso has the same MD5 checksum like the iso modified by Matt himself, so he definitley hasn't done anything else with the distros. I burned the iso to a DVD and installed it on the iMac. It is running just fine. Yet I haven't connected the computer to the internet since I am not sure if it is still safe to use.

I don't know anything about c programing so I'd like to ask if this little c program does anything more than just making the distro bootable? Is it still safe to use this distro or contains it some kind of virus?

  • 2
    I don't think it's writing a virus to the ISO image. It's modifying a very small section somewhere in the image, and if it makes it bootable, then that's all it does. – Kusalananda Jan 15 '19 at 18:55
  • Looks like a good workaround to me too. Nice and clean. He posted the c code with txt extension so it can be easily reviewed. No virus writer I know would want to display their goods like that. – Michael Prokopec Jan 15 '19 at 20:06
  • unfortunately, the linked code does not cleanly compile! When compiling, always enable the warnings, then fix those warnings, ( for gcc, at a minimum use: gcc -c -Wall -Wextra -Wconversion -pedantic -std=gnu11 myprogram.c -o myprogram`) Note other compilers use different options to perform the same functions – user3629249 Jan 15 '19 at 22:38
  • I would definately keep a copy of your original .iso file, so if things don't work as expected, you will not be left with (only) a corrupted file – user3629249 Jan 15 '19 at 22:48

You could compare the original image to the modified image using, e.g., cmp -l. (Which for true paranoia, you should of course do from a system you didn't run the C program on). That C program appears to just set 1984 bytes to 0:

if (lseek(fd, lba * 2048 + 64, SEEK_SET) == -1)
  goto err_ex;
memset(buf, 0, buf_size);
ret = write(fd, buf, buf_size);

... the rest of it looks like error checking and finding the offset at which to write those 0s.

It's possible writing 0s to something could be a backdoor (not a virus), e.g., by knocking out authentication somewhere. But it strikes me as unlikely (I don't think 0x00... is a machine-code noop), and the description of what it does on the page makes more sense.

You could also detect that hypothetical backdoor by verifying your packages' checksums (e.g., with debsums on Debian); writing all 0s isn't going to corrupt a program in a way that keeps its checksum good!

  • As elementary OS is based on Ubuntu and Ubuntu is based on Debian, I checked the checksums with debsums (without configuration files) and everything is OK. As far as I understand the command compares the checksums with lists, which are located on my computer (/var/lib/dpkg/info/). So the c program could have changed those lists, too and debsums wouldn't recognize corrupted packages, but to me this seems very unlikley as the code is too short to do that. However now I feel confident to use this modified distro. Thanks! – Domdat Jan 16 '19 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.