Messages in this thread | | | Subject | Re: [patch 1/2] [RFC] Simple tamper-proof device filesystem. | From | Tetsuo Handa <> | Date | Tue, 18 Dec 2007 12:40:25 +0900 |
| |
Hello.
Serge E. Hallyn wrote: > Nope, try > > touch /root/hda1 > ls -l /root/hda1 > mount --bind /dev/hda1 /root/hda1 > ls -l /root/hda1
[root@sakura ~]# touch /root/hda1 [root@sakura ~]# ls -l /root/hda1 -rw-r--r-- 1 root root 0 Dec 18 12:04 /root/hda1 [root@sakura ~]# mount --bind /dev/hda1 /root/hda1 [root@sakura ~]# ls -l /root/hda1 brw-r----- 1 root disk 3, 1 Dec 18 2007 /root/hda1
Oh, surprising. I didn't know mount() accepts non-directory for mount-point. But I think this is not a mount operation because I can't see the contents of /dev/hda1 through /root/hda1 . Can I see the contents of /dev/hda1 through /root/hda1 ?
> Then it sounds like this filesystem is something Tomoyo can use.
I had / partition mounted for read-only so that the admin can't do 'mknod /root/hda1 b 3 1' in 2003, and I named it "Security Advancement Know-how Upon Readonly Approach for Linux" or SAKURA Linux. This filesystem (SYAORAN) is developed to make /dev writable and tamper-proof when / partition is read-only or protected by MAC. TOMOYO is a pathname-based MAC implementation, and SAKURA and SYAORAN were merged into TOMOYO Linux. ;-)
Regards.
| |