ALT Linux Bugzilla – #810
APT: run download methods with less permissions
Last modified: 2017-07-24 16:50:34
You need to
before you can comment on or make changes to this bug.
/usr/lib/apt/ftp (and others) doesn\'t need all the root\'s permissions and
access to the whole filesystem to do its job, only read access to the source
(URL, CD-ROM) and write access to the cache.
So running the download methods under a simple special user and (perhaps) in a
chrooted environment could be a security improvement.
I\'m not sure whether this would be a real important security improvement...
But the download stage seems to be the only one when the APT system has to deal
with untrusted environment like the Internet; after the downoad is complete,
the signatures of the packages can be checked and a decision made whether to
Seems like requisite example in stock /etc/apt/apt.conf suffices in practice.
Ouch, missed the tab! (see #608)
This is about to be fixed in task #185681