hasher(7)

HASHER(7)

ALT

HASHER(7)

NAME

hasher - modern safe package building technology

SYNOPSIS

hsh [options] <path-to-workdir> <package>...

RATIONALE

Long ago, when instrumental OS distributions made by few developers were small enough to be placed on a single CD along with their sources, there was no real package building technology. Developers built their packages in host systems that were created by installing the whole OS distribution.

Nowadays instrumental OS distributions are made by dozens if not thousands of developers. They are too large to be installed wholly. As result, traditional package building scheme in host systems no longer fits the requirements: it is insecure, unsafe and awkward.

REQUIREMENTS

Modern package building technology should:

1.: not lower the host system security;
2.: protect itself from attacks installed by packages;
3.: protect package builds from attacks installed by other packages;
4.: ensure reliability of build results;
5.: provide reasonable performance.

ARCHITECTURE

The hasher architecture is based on a triple-user model: an unprivileged caller user (C) and two unprivileged pseudousers; the first one (R) emulates the root user in the generated build environment, the second one (U) emulates a regular user who builds software.

Switching between the caller user and the helper users is handled by a special program hasher-priv(8). It is written with extreme caution to defend from attacks installed by unprivileged users. It is also used to purge processes left after pseudousers, to create device files, to mount filesystems, and to control resources allocated for unprivileged processes to defend from DoS-attacks.

In general, the way of a source package in hasher during the build process looks as follows:

1. Generate aptbox.: User C generates an environment (aptbox) for apt.
2. Remove the build environment that could be left by previous builds.: The removal is done sequentially: inside the build chroot by user U, inside the build chroot by user R and finally outside the build chroot by user C.
3. Generate a new build chroot framework.: User C generates the framework, which consists of helper directories and statically linked helper programs: ash(1), find(1) and cpio(1).
4. Generate a basic install environment.: This environment contains everything necessary for regular package installs. User C using apt utilities determines the set of packages required to generate the install environment. User R using static helper programs unpacks these packages.
5. Generate a basic build environment.: This environment contains the tools required for every package build. User C using apt utilities determines the set of packages, user R installs them.
6. Generate build environment for this particular package.: User U fetches package build dependencies, user C using apt utilities determines the set of packages to install, and user R installs them.
7. Build the package.: User U executes the build.

These schemes are designed to eliminate attacks of the type U->R, U->C, R->C, and all attacks targeted to root.

In order to increase performance which is essential when building a lot of packages, hasher implements caching of the basic build environment, this allows to skip steps 4 and 5.

AUTHOR

Written by Dmitry V. Levin <ldv@altlinux.org> et al.

REPORTING BUGS

Report bugs to https://bugzilla.altlinux.org/

COPYRIGHT

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.