From owner-freebsd-stable@FreeBSD.ORG Tue Jul 3 11:13:58 2007 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id E29DC16A41F for ; Tue, 3 Jul 2007 11:13:58 +0000 (UTC) (envelope-from jhs@berklix.org) Received: from thin.berklix.org (thin.berklix.org [194.246.123.68]) by mx1.freebsd.org (Postfix) with ESMTP id 6FE7213C4AE for ; Tue, 3 Jul 2007 11:13:58 +0000 (UTC) (envelope-from jhs@berklix.org) Received: from js.berklix.net (p549A48BD.dip.t-dialin.net [84.154.72.189]) (authenticated bits=128) by thin.berklix.org (8.12.11/8.12.11) with ESMTP id l63BDhTw012045; Tue, 3 Jul 2007 13:13:44 +0200 (CEST) (envelope-from jhs@berklix.org) Received: from fire.js.berklix.net (fire.js.berklix.net [192.168.91.41]) by js.berklix.net (8.13.6/8.13.6) with ESMTP id l63BDclX019074; Tue, 3 Jul 2007 13:13:38 +0200 (CEST) (envelope-from jhs@berklix.org) Received: from fire.js.berklix.net (localhost.js.berklix.net [127.0.0.1]) by fire.js.berklix.net (8.13.8/8.13.8) with ESMTP id l63BDcZW036403; Tue, 3 Jul 2007 13:13:38 +0200 (CEST) (envelope-from jhs@fire.js.berklix.net) Message-Id: <200707031113.l63BDcZW036403@fire.js.berklix.net> To: Harald Schmalzbauer In-reply-to: <200707031127.07413.h.schmalzbauer@omnisec.de> References: <200707031127.07413.h.schmalzbauer@omnisec.de> Comments: In-reply-to Harald Schmalzbauer message dated "Tue, 03 Jul 2007 11:27:07 +0200." Date: Tue, 03 Jul 2007 13:13:38 +0200 From: "Julian H. Stacey" Cc: freebsd-stable@freebsd.org Subject: Re: regular user can destroy disk label?!? X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Jul 2007 11:13:59 -0000 Harald Schmalzbauer wrote: > Hello, > > accidentally I did 'bsdlabel -w ar0s2' as unprivileged user but it was > successfull. Likely you have a permissions problems. Report result of cd /dev ; ls -l . ar0s2 ad0s2 /sbin/bsdlabel On my 6.2-RELEASE for example I have an unwriteable combo of: dr-xr-xr-x 5 root wheel 512 Jan 1 1970 ./ crw-r----- 1 root operator 0, 110 Jun 21 09:03 ad0s2 crw-r----- 1 root operator 0, 123 Jun 21 11:03 ad0s2a -r-xr-xr-x 2 root wheel 233768 Apr 11 19:43 /sbin/bsdlabel* Either: - You made a typo with ar0s2 & meant ad0s2, - Or you really mean "ar" - man 4 ar reports a comms card ! - /dev/ar0s2 may be some meaningless normal file, not a device, but in /dev/ , writeable by you, from a previous mistake you made as root ? > Is this only possible because there was no mounted filesystem on it? No. Regardless what the code of bsdlabel.c might try, if it doesnt have SUID or SGID bits & isnt run as root, kernel won't allow it to write what it doesnt have permission for. > But I can imagine having data on unmounted filesystems. Possible yes but see above. > Is it intended that regular useres can overwrite the label? No. > That's a big fault in my opinion. No such fault to fear :-) BTW all above is general Unix philospohy, applies equally to Linux, *BSD & commercial Unixes, ref. any book on Unix permissions etc :-) > Best regards, > > -Harry Julian -- Julian Stacey. Munich Computer Consultant, BSD Unix C Linux. http://berklix.com HTML mail unseen. Ihr Rauch=mein allergischer Kopfschmerz. Dump cigs 4 snuff.