Mageia 10 rpmdrake Update (MGASA-2026-0160): Patching the Package Manager and Hardening Linux Software Installation Workflows

---
title: Package Manager Execution by Non-Administrative Context (Linux RPM/urpmi)
id: 3f9c2a71-6b48-4e1d-a5c7-9d2e4f6a8b01
status: experimental
description: Detects execution of RPM-based package management tooling (urpmi, rpmdrake, dnf, rpm with install/erase flags) which should be rare and attributable to change windows on managed Mageia/RPM systems.
references:
  - https://linuxsecurity.com/advisories/mageia/mageia-2026-0160-rpmdrake
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.supply_chain_compromise
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_tool:
    Image|endswith:
      - '/urpmi'
      - '/rpmdrake'
      - '/urpme'
      - '/dnf'
      - '/rpm'
  selection_install:
    CommandLine|contains:
      - ' --install'
      - ' -i '
      - ' -e '
      - ' --erase'
      - ' install '
      - ' remove '
  condition: selection_tool and selection_install
falsepositives:
  - Legitimate administrator patching activity and change windows
  - Configuration management (Ansible dnf/package modules)
level: medium
---
title: RPM Repository or Media Configuration Modification
id: 8b1d4e62-2c57-49f3-b6a1-7e5c3d9f2a44
status: experimental
description: Detects modification of RPM/urpmi repository configuration files, a technique used to point systems at attacker-controlled package sources for supply-chain compromise.
references:
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.supply_chain_compromise
  - attack.t1195.001
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/etc/urpmi/urpmi.cfg'
      - '/etc/urpmi/mirrorlist'
      - '/etc/yum.repos.d/'
      - '/etc/dnf/dnf.conf'
falsepositives:
  - Legitimate repository additions by administrators
level: high
---
title: Unsigned or Untrusted RPM Package Installed
id: 5c7a9f30-1d84-4b62-9e3f-2a6b8c4d7e55
status: experimental
description: Detects RPM installs executed with signature checking disabled (--nosignature, --nodigest, --force), which bypasses package integrity verification and is common in trojanized-package installation.
references:
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.supply_chain_compromise
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/rpm'
      - '/urpmi'
    CommandLine|contains:
      - '--nosignature'
      - '--nodigest'
      - '--force'
      - '--allow-untrusted'
falsepositives:
  - Rare; legacy internal packages lacking signatures
level: high

// Hunt for package management activity and repository tampering on Linux hosts
// ingested into Sentinel via Syslog/CEF (auditd process exec events)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in ("urpmi", "rpmdrake", "urpme", "rpm", "dnf", "dnf5")
   or SyslogMessage has_any ("urpmi", "rpmdrake", "yum.repos.d", "urpmi.cfg")
| extend Action = case(
    SyslogMessage has "--nosignature" or SyslogMessage has "--nodigest", "SignatureBypass",
    SyslogMessage has_any ("-i ", " install ", "--install"), "Install",
    SyslogMessage has_any ("-e ", "--erase", " remove "), "Removal",
    SyslogMessage has_any ("urpmi.cfg", "yum.repos.d"), "RepoConfigChange",
    "Other")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, Action
| order by TimeGenerated desc

-- Hunt for recently installed/erased RPM packages and repo config changes
-- Deploy as a hunt across Mageia/RPM endpoints
LET rpm_history = SELECT * FROM execve(
  argv=['/bin/rpm', '-qa', '--last'])

LET repo_configs = SELECT FullPath, Mtime, Size
FROM glob(globs=['/etc/urpmi/urpmi.cfg', '/etc/urpmi/mirrorlist', '/etc/yum.repos.d/*.repo'])
WHERE Mtime > now() - 7*24*3600

SELECT * FROM repo_configs

#!/bin/bash
# Mageia 10 rpmdrake update + package-state verification script
# Run as root on Mageia 10 systems

set -euo pipefail

echo "[*] Refreshing repository metadata..."
urpmi.update -a

echo "[*] Applying updates (includes rpmdrake fix from MGASA-2026-0160)..."
urpmi --auto-update --auto

echo "[*] Verifying rpmdrake installed version..."
rpm -q rpmdrake

echo "[*] Checking for any remaining pending updates..."
urpmi.update -a >/dev/null 2>&1
PENDING=$(urpmq --auto-select 2>/dev/null | wc -l)
if [ "$PENDING" -gt 0 ]; then
  echo "[!] WARNING: $PENDING packages still pending update:" >&2
  urpmq --auto-select
else
  echo "[+] No pending updates. System fully patched."
fi

echo "[*] Verifying package signature policy integrity (no unsigned packages installed)..."
UNSIGNED=$(rpm -qa --qf '%{NAME} %{SIGPGP:pgpsig}\n' | grep -c "(none)" || true)
if [ "$UNSIGNED" -gt 0 ]; then
  echo "[!] WARNING: $UNSIGNED packages with NO valid GPG signature found:" >&2
  rpm -qa --qf '%{NAME} %{SIGPGP:pgpsig}\n' | grep "(none)"
else
  echo "[+] All installed packages carry valid signatures."
fi

echo "[*] Auditing configured repositories for unexpected sources..."
cat /etc/urpmi/urpmi.cfg | grep -E 'url|mirrorlist' || true

echo "[*] Verifying RPM database consistency..."
rpm --verify -a 2>/dev/null | grep -E '^..5' | head -20 || echo "[+] No unexpected file digest changes flagged in spot check."

echo "[+] Done. Cross-check installed state with: rpm -qa --last | head -30"