linux-kernel - udev/aacraid interaction - should aacraid set 'removable'?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070103155749.GT13154@colo>
Date:	Wed, 3 Jan 2007 08:57:50 -0700
From:	dann frazier <dannf@...ian.org>
To:	mark_salyzyn@...ptec.com, linux-kernel@...r.kernel.org, md@...ux.IT
Cc:	404927@...s.debian.org, 404927-submitter@...s.debian.org,
	debian-kernel@...ts.debian.org
Subject: udev/aacraid interaction - should aacraid set 'removable'?

(lkml readers: this concerns a security issue reported to debian by a
user of udev/aacraid. udev gives the aacraid devices the floppy group
because it reports block devices as 'removable'. See
http://bugs.debian.org/404927 for the entire thread).

On Wed, Jan 03, 2007 at 11:49:51AM +0100, Marco d'Itri wrote:
> On Jan 03, dann frazier <dannf@...ian.org> wrote:
> 
> >  Can you elaborate on what you believe the kernel is doing
> > incorrectly? My first guess would be the setting of the removable
> > flag, but aacraid claims to be setting this to prevent partition table
> > caching - do you believe that to be an incorrect usage?
> Yes, this looks like an abuse of the interface to me.

Ok, let's ask lkml

> > It seems like there is precedence for workarounds for older kernels in
> > permissions.rules, so would it be appropriate to add an override of
> > the default floppy rule for aacraid devices for compatability even if
> > this is a kernel bug?
> There are workarounds for bugs which are going to be fixed, but looks
> like this is going to stay forever...
> Are there other drivers in this situation?

I didn't turn up any otherwise when I was grepping yesterday, but my
search terms may have been too naive. I also checked a machine I had
w/ cciss - it did not have the removable flag set.

I found a message from Mark Salyzyn from last year that suggested this
was more pervasive:
  http://www.ussg.iu.edu/hypermail/linux/kernel/0602.2/1231.html
Mark: Can you identify some of these other drivers?

-- 
dann frazier

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/