Re: [Security-Discuss] Mount issues in LE2005-Club - Security Issue

Frederik Himpe wrote:

>On zo, 2005-08-28 at 10:37 -0400, Albert Whale wrote:
>  
>
>>I've just noticed a problem with the mount command on:
>>Mandrakelinux release 10.2 (Limited Edition 2005) for i586
>>
>>The issue is with the /tmp filesystem.  I have selected the following
>>options to secure the mounting of /tmp:
>>grep tmp /etc/fstab
>>/dev/sdb1 /tmp ext3 nosuid,noexec,nodev 1 2
>>
>>However when I examine the options on the mounted filesystem, they
>>appear to not have been applied
>>mount | grep tmp
>>/dev/sdb1 on /tmp type ext3 (rw)
>>    
>>
>
>Have you actually tested if the partition is really mounted with the
>exec option then? In my experience, the mount command does not seem to
>always show the used mount options (e.g. I remember having seen this
>already with uid and gid options for smbfs mounts, on another distro,
>even though they are correctly working).
>  
>
Wow, You're kidding me?

I did prove that the reported FS Mounting is insecure.

How's this for additional proof

more /proc/filesystems
nodev   rootfs
nodev   bdev
nodev   proc
nodev   sockfs
nodev   tmpfs
nodev   shm
nodev   pipefs
        ext2
nodev   ramfs
nodev   devfs
nodev   nfs
nodev   devpts
        ext3
nodev   usbdevfs
nodev   usbfs
nodev   supermount

You'll notice that /tmp is not one of these listed.

But seriously, if the mount command fails to use the mount options, and 
then fails to report the options, then what would you say would be a 
valid test of the mounted filesystem?  An infected (or hacked) server?



-- 
Albert E. Whale, CHS CISA CISSP
Sr. Security, Network, Risk Assessment and Systems Consultant
-------------------------------------------------------------------
ABS Computer Technology, Inc. - www.ABS-CompTech.com
SPAM Zapper - No-JunkMail.com - Spam-Zapper.com - SPAM Stops Here.
President of the Pittsburgh InfraGard Alliance

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________