OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: /proc filesystem allows bypassing directory permissions on

From: Gabor Gombas (gombasgsztaki.hu)
Date: Tue Nov 03 2009 - 03:32:11 CST


On Tue, Nov 03, 2009 at 12:33:28AM +0100, Martin Rex wrote:

> > "mount --bind" behaves like a hard link and it does not increment the link
> > count.
>
> that seems to work similar to a hardlink on a directory (and also requires
> root privileges). It doesn't work for the same directory level, because
> of this (the directory permissions of the mounted directories and
> directories below it remain effective -- the permissions of directories
> above disappear, however!

I was speaking about single file bind-mounts, not directories.

# touch /tmp/a
# mount --bind /etc/passwd /tmp/a
# ls -l /etc/passwd
-rw-r--r-- 1 root root 1990 2009-08-24 16:22 /etc/passwd
# cat /tmp/a
root:x:0:0:root:/root:/bin/bash
[...]

Two references to the same inode, yet the link count is 1 and /proc is
nowhere in the picture.

Gabor

--
     ---------------------------------------------------------
     MTA SZTAKI Computer and Automation Research Institute
                Hungarian Academy of Sciences
     ---------------------------------------------------------