Re: scary, maybe

On Fri, 18 Oct 2002, Sam Halliday wrote:

> On Fri, 18 Oct 2002 01:45:37 +0100 Ian Molton <[email protected]> wrote:
> > > ...and unless you went out of your way to make the system reserve 0%
> > > of the filesystem for use by root, a user trying that wouldn't be
> > > able to kill the system--just piss off the other users.
> yeah, thats always going to be a problem with /tmp and /var isnt it...
> but the script was finding files which raised this problem on the root
> filesystem, or possibly a network drive. thats the point i was making,
> some packages dont correctly install their files (often man pages) and i
> just wish i took a note of them when i first ran the script...

Don't forget /home.  Anything that gets written to on irregular intervals
(or can be written to by users, like /tmp, or caused to be written to by
users, like /var/log, /var/spool) can usually benefit from just being put
into it's own partition simply to keep it from taking any other subsystems
with it, should it go berzerk and fill up it's filesystem when an admin
isn't around to intercede (read: all the time).

For example, a reasonably hardened nameserver chrooted to it's own
partition isn't going to affect the system by filling itself up with
corrupted zone files or hacker nonsense, in addition to keeping the system
immune to scampering inode tricks to escape the chroot.

-- 
Unsubscribe: send email to [email protected]
and put 'unsubscribe lfs-security' in the subject header of the message