lkml.org 
[lkml]   [2007]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [patch 1/2] [RFC] Simple tamper-proof device filesystem.
    From
    Date
    Hello.

    Radoslaw Szkodzinski (AstralStorm) wrote:
    > Actually, who needs to create device nodes? Just prohibit everyone from
    > creating them, except "installer" and "udev" personality.
    > This means removing CAP_MKNOD on a global scale.

    What happens if the root tampers udev's configuration file?
    The udev will create inappropriate (i.e. filename with unexpected attributes)
    device nodes, won't it?

    Also, creating device nodes is not the only threat.
    The root can do
    # mv /dev/sda1 /dev/tmp; mv /dev/sda2 /dev/sda1; mv /dev/tmp /dev/sda2
    to rename/unlink device nodes.

    After all, revoking CAP_MKNOD is not enough for guaranteeing
    filename and its attributes.

    This filesystem is designed to guarantee filename and its attributes,
    but this filesystem has additional access control capability.
    You can forbid mknod/unlink /dev/null if you want nobody to do so.
    You can forbid chmod/chown /dev/null if you want nobody to do so.

    Well... it is not fair to refer only udev's configuration file.
    If configuration file of this filesystem is tampered,
    this filesystem will create inappropriate device nodes.
    So, some access control mechanism for protecting configuration files
    is recommended for both udev and this filesystem.

    Regards.


    \
     
     \ /
      Last update: 2007-12-19 13:13    [from the cache]
    ©2003-2011 Jasper Spaans