lkml.org 
[lkml]   [2000]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: disk-destroyer.c
Date
From
Andre Hedrick wrote:
> On Thu, 20 Jul 2000, Paul Jakma wrote:
>
> > On Wed, 19 Jul 2000, Andre Hedrick wrote:
> >
> > >
> > > Here is the rouge program that can be slipped into CRON.
> > > A perl script......you name the access point and it gets permission
> > > KISS your DATA GONE!
> > >
> >
> > it needs root right? so with this util root can trash the disk.. so what's
> > new?
>
> All you have to do is trick the kernel into thinking the access is root.

Whenever I trick the kernel to think that I'm Accessing something as
root, I have instant permanent Root-access. Wether I can write to ONE
disk block (which happens to contain the inode of the copy of /bin/sh
that I have prepared in my homedir) or I can change the "current->uid"
in main memory.

Whenever I trick the kernel into thinking I'm root for an instant,
that can be leveraged to "permanent root" and/or a wipe of the disk.

I hope that "sending raw packets to the disk" is a priviledged
operation, and not something that simply depends on the permissions on
the disk device?

Roger.


--
** R.E.Wolff@BitWizard.nl ** http://www.BitWizard.nl/ ** +31-15-2137555 **
*-- BitWizard writes Linux device drivers for any device you may have! --*
* Common sense is the collection of *
****** prejudices acquired by age eighteen. -- Albert Einstein ********

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.221 / U:0.528 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site