Some thoughts about anti-virus software for Linux

[Florian Diesch]

Mario Vukelic <mario.vukelic at dantian.org> wrote:

> On Thu, 2009-01-22 at 09:37 -0500, Brian McKee wrote:
>> If you install software from the repositories, you used root
>> privileges to do so.  Therefore, the program you installed now can run
>> as root whenever it wants to.
>
> This is not true. Usually the program will run with the privileges of
> the user that starts it. The programs that run with root privileges are
> very rare, despite all packages being installed by APT (in a standard
> Ubuntu system).


During the installation some scripts are run as root. An attacker
could use this scripts to compromise your system if he can make you to
install a compromised package.

Therefor it's important to use only trustworthy repositories and be
careful if a package's signature can't be verified.



   Florian
-- 
<http://www.florian-diesch.de/>
-----------------------------------------------------------------------
**  Hi! I'm a signature virus! Copy me into your signature, please!  **
-----------------------------------------------------------------------