Re: [Security-Discuss] Mount issues in LE2005-Club - Security Issue

* Albert Whale <[email protected]> [2005-08-28 11:04:24 -0400]:

> >>I've just noticed a problem with the mount command on:
> >>Mandrakelinux release 10.2 (Limited Edition 2005) for i586
> >>
> >>The issue is with the /tmp filesystem.  I have selected the following
> >>options to secure the mounting of /tmp:
> >>grep tmp /etc/fstab
> >>/dev/sdb1 /tmp ext3 nosuid,noexec,nodev 1 2
> >>
> >>However when I examine the options on the mounted filesystem, they
> >>appear to not have been applied
> >>mount | grep tmp
> >>/dev/sdb1 on /tmp type ext3 (rw)
> >>   
> >>
> >
> >Have you actually tested if the partition is really mounted with the
> >exec option then? In my experience, the mount command does not seem to
> >always show the used mount options (e.g. I remember having seen this
> >already with uid and gid options for smbfs mounts, on another distro,
> >even though they are correctly working).
> > 
> >
> Wow, You're kidding me?
> 
> I did prove that the reported FS Mounting is insecure.
> 
> How's this for additional proof
> 
> more /proc/filesystems
> nodev   rootfs
> nodev   bdev
> nodev   proc
> nodev   sockfs
> nodev   tmpfs
> nodev   shm
> nodev   pipefs
>        ext2
> nodev   ramfs
> nodev   devfs
> nodev   nfs
> nodev   devpts
>        ext3
> nodev   usbdevfs
> nodev   usbfs
> nodev   supermount
> 
> You'll notice that /tmp is not one of these listed.
> 
> But seriously, if the mount command fails to use the mount options, and 
> then fails to report the options, then what would you say would be a 
> valid test of the mounted filesystem?  An infected (or hacked) server?

File a report on bugzilla (qa.mandrakesoft.com) please.

-- 
Annvix - Secure Linux Server: http://annvix.org/
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFDEzA+LrxeMv7jCtQRAo3aAJ0T4JASFqpHINWZgWXcshEpzaoEhQCfdBWP
MlBjGSU4S7ranK+p3tOCQ1I=
=26kW
-----END PGP SIGNATURE-----