[Ksummit-discuss] [CORE TOPIC] dev/maintainer workflow security

[James Bottomley]

On Mon, 2015-07-13 at 10:07 -0400, Konstantin Ryabitsev wrote:
> On Mon, Jul 13, 2015 at 10:32:06AM +0200, Jiri Kosina wrote:
> > If the credentials can be used both to push to ra.kernel.org and to access 
> > your "local" copy of the GIT repo (on your notebook / desktop / storage), 
> > I can just push the malicious commit (*) to both repos and you might not 
> > notice immediately (because you wouldn't get non-fast-forward hint from 
> > git).
> 
> This is mitigated somewhat by existing 2-factor mechanisms placed on
> select git repositories.
> 
> https://korg.wiki.kernel.org/userdoc/gitolite_2fa
> 
> To successfully attack in this manner, you would need to push to
> gitolite.kernel.org from an IP address that's been previously
> 2fa-validated by the developer.
>
> Which brings me around to grumbling a bit -- since we've made 2-factor
> auth available, only 30 people have set up a token[*] (not even 10% of all
> account holders) and only 25 repositories/subdirs have a 2fa requirement
> on them, out of 450 defined.
>
> I'm far from suggesting that we make this mandatory, but I'm open to
> any suggestions on how we can make more developers enroll with 2fa.

It's a bit painful for those of us who move around a lot and no-one has
ever articulated a clear threat vector it's supposed to counter.

In fact, I'd argue it gives a false sense of security: the ssh keys and
authentication factors aren't what I'd go after if I were attacking
kernel.org because anything I pushed using a stolen key would instantly
be noticed the next time the maintainer pushed and the tree wouldn't
fast forward.  If I were trying to get a bogus commit into the tree, I'd
be attacking the maintainer's laptop to put it into their personal git
tree (I'd actually tack the code on to an existing commit via rebase ...
cleverly choosing a commit they hadn't yet pushed), so no-one would
notice when it was pushed to kernel.org and it would be properly
accounted for in the subsequent pull request to Linus.  2 factor
authentication does nothing to counter this.

James


> Best,
> _______________________________________________
> Ksummit-discuss mailing list
> Ksummit-discuss at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/ksummit-discuss


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxfoundation.org/pipermail/ksummit-discuss/attachments/20150713/929b56fe/attachment.sig>