diff options
| author | Julian Andres Klode <julian.klode@canonical.com> | 2018-01-29 16:15:41 +0100 |
|---|---|---|
| committer | Julian Andres Klode <julian.klode@canonical.com> | 2018-02-19 16:05:01 +0100 |
| commit | 9e5899cac1a6367e3769af52a724821880e538f6 (patch) | |
| tree | 4c7add81aeb5f851ce764697b03e3778391f9cbc /doc/apt.conf.5.xml | |
| parent | 38d444af2632219ab399dabadaaefaa4dcdd6ebf (diff) | |
Check that Date of Release file is not in the future
By restricting the Date field to be in the past, an attacker cannot
just create a repository from the future that would be accepted as
a valid update for a repository.
This check can be disabled by Acquire::Check-Date set to false. This
will also disable Check-Valid-Until and any future date related checking,
if any - the option means: "my computers date cannot be trusted."
Modify the tests to allow repositories to be up to 10 hours in the
future, so we can keep using hours there to simulate time changes.
Diffstat (limited to 'doc/apt.conf.5.xml')
| -rw-r--r-- | doc/apt.conf.5.xml | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/doc/apt.conf.5.xml b/doc/apt.conf.5.xml index fdcd99425..e285b3130 100644 --- a/doc/apt.conf.5.xml +++ b/doc/apt.conf.5.xml @@ -315,6 +315,27 @@ APT::Compressor::rev { for the download itself (see also &sources-list;).</para> <variablelist> + <varlistentry><term><option>Check-Date</option></term> + <listitem><para> + Security related option defaulting to true, enabling time-related + checks. Disabling it means that the machine's time cannot be + trusted, and APT will hence disable all time-related checks, + such as <option>Check-Valid-Until</option> and verifying that + the Date field of a release file is not in the future. + </para></listitem> + </varlistentry> + + <varlistentry><term><option>Max-FutureTime</option></term> + <listitem><para>Maximum time (in seconds) before its creation (as indicated + by the <literal>Date</literal> header) that the <filename>Release</filename> + file should be considered valid. + + The default value is <literal>10</literal>. + Archive specific settings can be made by appending the label of the archive + to the option name. Preferably, the same can be achieved for specific + &sources-list; entries by using the <option>Date-Max-Future</option> option there. + </para></listitem> + </varlistentry> <varlistentry><term><option>Check-Valid-Until</option></term> <listitem><para> Security related option defaulting to true, as giving a Release file's |