Messages in this thread | | | Date | Sat, 22 Jul 2000 00:10:56 -0400 (EDT) | From | Stephen Frost <> | Subject | Re: scsi-destroyer.c to come... |
| |
On Fri, 21 Jul 2000, Andre Hedrick wrote:
> > > > On Fri, 21 Jul 2000, Stephen Frost wrote: > > > And yet you would need to be root to do this, and I would suspect > > it *much* more likely a clueless root user would cat junk to /dev/sda than > > a program run as root which uses ioctl's would clobber it's own memory > > space and nuke the disk. Probably alot more likely any such program would > > segfault before doing much actually. > > Assume a security exploit of you /bin/bash.
If you assume the abuser has root there is *nothing* you can do.
> The publish ATA and SCSI program codes have been defined small enough to > push into a shellstack "memory push" buy a clever non-root user.
It doesn't make *any* real difference how big the programs are. If the abuser has root access it won't make *any* difference.
> NO-ROOT involved here 'users.users'
This is false. You have already defined that the user has root above. If the user does *not* have root access and can still cause such damage then the exploit should be fixed.
> Is this clear enough.
You are intentionally obfuscating the issue by making claims and assumptions and then trying to claim you didn't.
> Now if you want to bet you butt on your security protocols are perfect, > GO-AWAY! Stop pumping garbage into a serious issue.
If the security isn't perfect how about we *fix* them instead of trying to fix the impossible. If the abuser has root it isn't going to make any difference. Hell, the abuser could *reboot* the machine into some stupid OS and set it up such that it blows away the disk. So much for all of the crap we stuck in the linux kernel to not allow this. Now we have a bunch of crap in the kernel that doesn't actually protect anything. I thought the general idea was that excess crap in the kernel was *bad*.
Stephen
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |