lkml.org 
[lkml]   [2004]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: dynamic /dev security hole?

On Mon, 9 Aug 2004, Marc Ballarin wrote:
> +Q: Are there any security issues that I should be aware of?
> +A: When using dynamic device numbers, a given pair of major/minor numbers may
> + point to different hardware over time. If a user has permission to access a
> + specific device node directly and is able to create hard links to this node,
> + he or she can do so to create a copy of the device node. When the device is
> + unplugged and udev removes the device node, the user's copy remains.
> + If the device node is later recreated with different permissions the hard
> + link can still be used to access the device using the old permissions.

Just an idea for a fix for this problem: If udev would change the
permissions to 000 and ownership to root.root just before it unlinks
the device node, the copy would become useless.

Eric
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:05    [W:0.061 / U:4.304 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site