Re: securety related question...

* Erika Pacholleck <[email protected]> [2002-10-07 07:34]:
> [06.10.2002] Bill maltby - LFS Related <-- :
> > On Sun, 6 Oct 2002, Richard Lightman wrote:
> > 
> > > Could you check that you can bind a rw device ro? I read somewhere
> > > that there was a patch to keep separate mount flags for each mount,
> > > but it does not appear to be there yet:
> > 
> > I get the same results with the same version of mount that you have.
> > Further, if I do a "remount,ro", the remount affects the "base" mount as
> > well as the bound mount. So, until separate flags for the bound mount
> > point become available, there is reduced security available for the "host"
> > partition if it must be mounted rw.
> 
> Isn't it logical? The --bind is the only option (no additionals) and its
> purpose is to make the *already mounted* partition available at another
> place, that *same* partition (and this means with all its flags).
> 
[root@urusai root]# mount --bind /mnt/backup/sources/ /floppy/
[root@urusai root]# umount /mnt/backup/
[root@urusai root]# ls /floppy/ftp.uk.kernel.org/pub/linux/utils
abi  boot  cpu  fs  kbd  kernel  man  util-linux
[root@urusai root]# ls /mnt/backup/
[root@urusai root]#

It looks to me like the implementation does not match the way you
expect --bind to behave.


> How are we going to end up, if --bind would allow to change the flags,
> suddenly a by intention mounted ro partition will be rw, and what you
> believe protected by ro is suddenly deleted via the bound mounting point!
> 
I used to mount my 'root' ro partition at /mnt/root, then bind
/mnt/root/{bin,etc,lib,opt,sbin,usr} to /{bin,etc,lib,opt,sbin,usr}
ro. I thought that I could then remount /mnt/root rw, and install
there using DESTDIR without letting anything modify /bin/*.
I was a bit shocked to find /bin became rw when I remounted /mnt/root.
So mount --bind does not act the way I expected it to behave either.

I hope the the ro and rw options will be respected each time that
they are used. I do not see any harm in mounting a partition ro,
and binding a part of it rw somewhere else if that is what I explicitly
tell the kernel to do.

I can see plenty of uses for this sort of thing. Some root kits try to
run programs from silly places. You could protect yourself from script
kiddies by mount /tmp noexec. If you move you init scripts, you can do
the same for /etc. You can have everything but /dev nodev, and
everything but {,/usr}/bin nosuid.

Richard
-- 
Unsubscribe: send email to [email protected]
and put 'unsubscribe lfs-security' in the subject header of the message