Comment by Genbox | Hacker News Reader

Comment by Genbox | Hacker News Reader

Parent Full thread

Verification of packages is something that is controlled by the distro, not the Linux kernel. However, if we are talking about drivers (modules), then they are verified at load time in both operating systems.

As for Windows packages, there are several "package" systems:

- AppInstaller (winget): A SHA256 hash is included in the application manifest. I might be wrong, but I do not believe the manifests are signed afterwards. Packages are verified upon installation.

- MSIX packages: They are signed and timestamped with a publisher certificate. They are verified upon installation.

- Executables: Not really packages as such, but PS1 scripts and .EXE executables support Authenticode signatures. They are verified upon execution.

As for Linux, there are several package systems:

- DPKG/DEB: Built-in support for verification with hashes generated at install time. Packages can be GPG signed for stronger security, but it is disabled by default. Repository metadata is often GPG signed.

- RPM: Like DEB above it supports verification with MD5. It also has GPG integration. I believe it is disabled by default as well.

Linux does unfortunately not have support for signatures of ELF executables.

> Linux does unfortunately not have support for signatures of ELF executables

Fortunately. This whole pseudo security brings nothing.

People scream about right to repair. When certificate is revoked or has expired your computer will stop working. It's that simple.

It is not pseudo security. A secure booted system that can only load signed software is the optimal solution for preventing unauthorized code from running. iOS on iPhone/iPad is a great example where you can be sure nobody can insert themselves into the OS unless it is signed by Apple.

There is nothing in Secure Boot that prevent people from running their own software. You can update the Secure Boot DB/DBX with whatever you want. Yes, the certificates expire - my computer was bought 4 years ago and Microsoft's UEFI CA will expire in 4 years. At that point I will probably have bought a new computer, but if I have not, I can update the certificate to the new one they released.

Secure Boot is very much an improvement over non-secure booting, and Authenticode signing is an extension of that security to enable signed-only software to run.

It is pseudo-security. SElinux and "mount noexec" already provide sysadmins with control over all the code that can be executed on a machine.

> It is not pseudo security. A secure booted system that can only load signed software is the optimal solution for preventing unauthorized code from running. iOS on iPhone/iPad is a great example where you can be sure nobody can insert themselves into the OS unless it is signed by Apple.

Pegasus.

Reply on news.ycombinator.com