linux-kernel - Re: [patch 1/2] [RFC] Simple tamper-proof device filesystem.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200712180340.lBI3eQk3039357@www262.sakura.ne.jp>
Date:	Tue, 18 Dec 2007 12:40:25 +0900
From:	Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:	serge@...lyn.com
Cc:	"\"\\\"Serge E. Hallyn\\\"\"" <serue@...ibm.com>,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	Linux Containers <containers@...ts.osdl.org>
Subject: Re: [patch 1/2] [RFC] Simple tamper-proof device filesystem.

Hello.

Serge E. Hallyn wrote:
> Nope, try
> 
>   touch /root/hda1
>   ls -l /root/hda1
>   mount --bind /dev/hda1 /root/hda1
>   ls -l /root/hda1

[root@...ura ~]# touch /root/hda1
[root@...ura ~]# ls -l /root/hda1
-rw-r--r-- 1 root root 0 Dec 18 12:04 /root/hda1
[root@...ura ~]# mount --bind /dev/hda1 /root/hda1
[root@...ura ~]# ls -l /root/hda1
brw-r----- 1 root disk 3, 1 Dec 18  2007 /root/hda1

Oh, surprising.
I didn't know mount() accepts non-directory for mount-point.
But I think this is not a mount operation
because I can't see the contents of /dev/hda1 through /root/hda1 .
Can I see the contents of /dev/hda1 through /root/hda1 ?

> Then it sounds like this filesystem is something Tomoyo can use.

I had / partition mounted for read-only so that the admin can't do
'mknod /root/hda1 b 3 1' in 2003, and I named it
"Security Advancement Know-how Upon Readonly Approach for Linux" or SAKURA Linux.
This filesystem (SYAORAN) is developed to make /dev writable and tamper-proof
when / partition is read-only or protected by MAC.
TOMOYO is a pathname-based MAC implementation, and
SAKURA and SYAORAN were merged into TOMOYO Linux. ;-)

Regards.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/