[lkml]   [2003]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: hard links create local DoS vulnerability and security problems
    On Mon, 24 Nov 2003, Jakob Lell wrote:

    > Hello,
    > on Linux it is possible for any user to create a hard link to a file belonging
    > to another user. This hard link continues to exist even if the original file
    > is removed by the owner. However, as the link still belongs to the original
    > owner, it is still counted to his quota. If a malicious user creates hard
    > links for every temp file created by another user, this can make the victim
    > run out of quota (or even fill up the hard disk). This makes a local DoS
    > attack possible.

    You can create hard-links to any file that a user has given you
    permission to read or execute. This is correct. The new hard-link
    still belongs to the original user, which is also correct.

    To prevent this, a user can set his default permissions so that
    neither group nor world can read the files. This is usually done
    by setting the attributes in the user's top directory.

    > Furthermore, users can even create links to a setuid binary. If there is a
    > security whole like a buffer overflow in any setuid binary, a cracker can
    > create a hard link to this file in his home directory. This link still exists
    > when the administrator has fixed the security whole by removing or replacing
    > the insecure program. This makes it possible for a cracker to keep a security
    > whole open until an exploit is available. It is even possible to create links
    > to every setuid program on the system. This doesn't create new security
    > wholes but makes it more likely that they are exploited.

    A setuid binary created with a hard-link will only work as a setuid
    binary if the directory it's in is owned by root. If you have users
    that can create files or hard-links within such directories, you
    have users who either know the root password already or have used
    some exploit to become root. In any case, it's not a hard-link

    > To solve the problem, the kernel shouldn't allow users to create hard
    > links to
    > files belonging to someone else.

    No. Users must be able to create hard links to files that belong
    to somebody else if they are readable. It's a requirement.

    Dick Johnson
    Penguin : Linux version 2.4.22 on an i686 machine (797.90 BogoMips).
    Note 96.31% of all statistics are fiction.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:58    [W:0.024 / U:4.748 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site