lkml.org 
[lkml]   [2000]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: IF only........
In <Pine.LNX.4.10.10007211552440.15902-100000@master.linux-ide.org> Andre Hedrick (andre@linux-ide.org) wrote:

>> Andre, I quite grasp this. I stand by my earlier statement. If it can
>> be fixed, write the patch and put it in and go on with life. With all

> I wrote the patch but it is not wanted "ide.2.4.0-t5-2.all.4c.patch.bz2"

Grrr. So you need improved version of disk-destroyer.c to be usable with
your ide.2.4.0-t5-2.all.4c.patch.bz2 ? Or do you think it's hard to do ?
It's two hours work (if not half-hour) but I need 2.4.0-test5 kernel (and
spare drive to test it). If you REALLY think it's big problem I'll do it.
Should I ? Hint: you can install code equivalent of old disk-destroyer.c
in case HDIO_DRIVE_CMD: branch via /dev/kmem - there are more then enough
space to do it; especially with your chechks :-) Of course after that you
can not use HDIO_DRIVE_CMD as before but you can restore it back after
destroying drive.

> I proved the tool to try and break it.

>> this carrying on, it's just advertising for the malicious kiddie.
>> Patches like this should be written and quietly introduced into the
>> kernel and a tiny blurb made in the ChangeLog saying "ATA protocol
>> violations prohibited". If it can't be fixed, the advertising of a
>> bad design flaw is certainly not a good thing.

> I tried and failed to get it in........
> It is so important that people need to be aware.

Yes, now they are VERY aware. Sigh.

>> Everybody would be inherently safer from the malicious kiddie who
>> doesn't [yet] know how to break things and may never know.

> Not if you do not know about it and the protection is denied.

EVEN if protection will be accepted it does not buy you much (if at all).
That's the point.

>> By carrying on about it for a week, it's a nice honeypot for that
>> malicious kiddie to search the archives and build a workable exploit to
>> destroy hardware.

> I exposed it because was exposed. And shown to me.
> I was not looking for this but it was shown to me and when I finally
> figured out what to make of it and do. Nothing happened...

Yes. Since it's just wrong thing to do. Perhaps you should change capabilities
check so you need not administrative privileges but also raw I/O privileges to
use HDIO_DRIVE_CMD but it's not papering over hole like your patch is.




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:1.039 / U:0.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site