From the question How to verify that package-installed files match originals? I understand that you can run the following command for a package:
dpkg -V <package>
The reason why I am carrying out this audit is, however, because I somehow suspect that the system could be compromised.
If the attacker has managed to subvert <package>, he could also have managed to subvert the dpkg audit command itself. Therefore, I cannot trust the self-referential audit:
dpkg -V dpkg
Therefore, I want to run the self-audit of the dpkg command from another system.
So, I mount the disk of this computer as folder /mnt/audit in my second computer, which I still trust. Now, I want to audit the installation foot print of dpkg in /mnt/audit from this second computer. What command do execute on my second computer? Is there an option that allows me to do something similar to the following:
dpkg -V dpkg --remote-target /mnt/audit
Once I trust the self-audit of dpkg, I should be able to trust its output for <package> as well.