lkml.org 
[lkml]   [1998]   [Dec]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: autofs vs. Sun automount -- new fs proposal
Peter Benie writes:
> Richard Gooch writes ("Re: autofs vs. Sun automount -- new fs proposal"):
> > Peter Benie writes:
> > > Richard Gooch writes ("Re: autofs vs. Sun automount -- new fs proposal"):
> > > > Peter Benie writes:
> > > > > I don't actually see the point of implementing a read-only loopback
> > > > I guess you never notice the CERT security notices, then?
> > >
> > > Are you suggesting that on Linux, one user can write to another's
> > > files? (I'm assuming that people aren't stupid enough to have world
> > > writable files etc.) If so, that's a bug that should be fixed.
> >
> > I'm pointing out that network servers are commonly attacked because
> > they have bugs in them. Some of these bugs allow crackers to write
> > files they shouldn't.
>
> If the server is running as one uid, and the file is owned by a
> different uid, then no amount of cracking will allow the server to
> write to the file (at least, not directly).
>
> A server might write to the file indirectly by exploiting bugs in
> privileged programs on the same machine. Chroot guards against most of
> those attacks.

"Most" != "all".

> > Sometimes network servers have to run as root.
>
> For most network servers, the part that must run as root is very
> small. Many servers are misdesigned and run all their code as root,
> but read-only lofs is not a quick fix for that problem.

No, but it provides an extra level of security.

> > One of the most common bugs I see in CERT announcements is that some
> > or other server isn't preventing unauthorised writing to some file. A
> > read-only lofs offers strong protection against that.
>
> root can change the mount options for the loopback mount, or it can
> access /root/.rhosts, /etc/shadow etc. without going through the
> loopback mount. read-only loopback mounts offer no protection from
> programs running as root.

Most of the exploits I see published in CERT relate to violating file
permissions, not to running arbitrary code as root. That's not to say
that the latter doesn't happen, just that the former seems more
likely. It's easier to find a file access weakness to exploit than a
root execution weakness.

> Do you have any real applications for read-only loopback mounts that
> cannot be solved using conventional, portable techniques?

Yeah, network servers, like I said. I've found "mount -o ro" to be
pretty portable. I don't think it's fair to label a read-only lofs as
unconventional and unportable.

Regards,

Richard....

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:46    [W:0.220 / U:0.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site