Re: securety related question...

[07.10.2002] Richard Lightman <-- :
> * Erika Pacholleck <[email protected]> [2002-10-07 07:34]:
> > 
> > Isn't it logical? The --bind is the only option (no additionals) and its
> > purpose is to make the *already mounted* partition available at another
> > place, that *same* partition (and this means with all its flags).
> > 
> [root@urusai root]# mount --bind /mnt/backup/sources/ /floppy/
> [root@urusai root]# umount /mnt/backup/
> [root@urusai root]# ls /floppy/ftp.uk.kernel.org/pub/linux/utils
> abi  boot  cpu  fs  kbd  kernel  man  util-linux
> [root@urusai root]# ls /mnt/backup/
> [root@urusai root]#
> 
> It looks to me like the implementation does not match the way you
> expect --bind to behave.

On the contrary, it behaves exactely as I expect.
If you umount /mnt/backup it's clear you can't ls anything, but this
does *not* mean you umount /floppy (why should it, you did not order
that), so that one is still mounted and if you compare the mount flags
you will see, that it keeps the original flags.

> > How are we going to end up, if --bind would allow to change the flags,
> > suddenly a by intention mounted ro partition will be rw, and what you
> > believe protected by ro is suddenly deleted via the bound mounting point!
> > 
>
> I used to mount my 'root' ro partition at /mnt/root, then bind
> /mnt/root/{bin,etc,lib,opt,sbin,usr} to /{bin,etc,lib,opt,sbin,usr}
> ro.

and /mnt/root is physically *one* partition, right?

> I thought that I could then remount /mnt/root rw, and install
> there using DESTDIR without letting anything modify /bin/*.
> I was a bit shocked to find /bin became rw when I remounted /mnt/root.
> So mount --bind does not act the way I expected it to behave either.

The --bind operates on *partitions*, just like any other mount whatever
command, and not on directory structures.

> I hope the the ro and rw options will be respected each time that
> they are used.

They are if 1.) you use the remount option for an already mounted
partition and 2.) you apply it to partitions and not directories.

> I do not see any harm in mounting a partition ro, and binding a part
> of it rw somewhere else if that is what I explicitly tell the kernel
> to do.

What about a program which uses these kind of bindings arbitrarily and
then deletes whatever is in it, and before you can do anything just
starts it(not)self. I'm no programmer but I guess it is possible to
write a program which withstands a kill signal by catching it and the
only chance you might have then, would be to pull the power supply.
If you can tell the kernel explicitly anything else might also, same
would go for that new `mount --move` command - that's why I think it is
better not to have this possibility at all.

> I can see plenty of uses for this sort of thing. Some root kits try to
> run programs from silly places. You could protect yourself from script
> kiddies by mount /tmp noexec. If you move you init scripts, you can do
> the same for /etc. You can have everything but /dev nodev, and
> everything but {,/usr}/bin nosuid.

Right, but you can achieve all this already.
-- 
Erika ...---...: pacholleck at nexgo dot de
-- 
Unsubscribe: send email to [email protected]
and put 'unsubscribe lfs-security' in the subject header of the message