From owner-freebsd-security Tue Dec 28 11:31:18 1999 Delivered-To: freebsd-security@freebsd.org Received: from gndrsh.dnsmgr.net (GndRsh.dnsmgr.net [198.145.92.4]) by hub.freebsd.org (Postfix) with ESMTP id CF11714D68 for ; Tue, 28 Dec 1999 11:31:09 -0800 (PST) (envelope-from freebsd@gndrsh.dnsmgr.net) Received: (from freebsd@localhost) by gndrsh.dnsmgr.net (8.9.3/8.9.3) id LAA70952; Tue, 28 Dec 1999 11:30:35 -0800 (PST) (envelope-from freebsd) From: "Rodney W. Grimes" Message-Id: <199912281930.LAA70952@gndrsh.dnsmgr.net> Subject: Re: Mounting / Read-Only In-Reply-To: from "Brian W. Buchanan" at "Dec 28, 1999 11:19:42 am" To: brian@CSUA.Berkeley.EDU (Brian W. Buchanan) Date: Tue, 28 Dec 1999 11:30:34 -0800 (PST) Cc: beaupran@iro.umontreal.ca (Spidey), freebsd-security@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL54 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > On Tue, 28 Dec 1999, Spidey wrote: > > > I was also wondering... If we can modify the status (RW/RO) of a > > mounted filesystem (/ included) with mount -u, why bother? :)) > > > > What is the purpose of mounting a filesystem ReadOnly, since it can be > > disabled? Does it serve the same function as the schg flag? I think > > the securelevel does not change this behavior, right? > > Mounting a filesystem read-only is not a security measure. I disagree, mounting a filesystem read-only _is_ a security measure, it can prevent certain attacks that may not have compromised root, but say they did manage to compromise something that would allow them to write a file in /usr/bin, if /usr/bin/ is read-only the are SOL, if it is r/w they be having root in a few minutes... > It gains you > nothing if root is compromised. But it gains you a lot if it defeats them from getting root. From someone who almost always runs /usr RO.... -- Rod Grimes - KD7CAX @ CN85sl - (RWG25) rgrimes@gndrsh.dnsmgr.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message