-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/06/2011 10:15 AM, phil wrote:
Usually Master Boot Record, but Microsoft has semi-equivalents for their removable storage, IFS Insert File System, drivespace and DoubleSpace, whereas the MBR is key to the partition settings for a hard drive, similar protections can be expected to be helpful for the partition controls for non-spinning systems.
Using a write protected flash drive for content to prevent it's alteration can take advantage of spanning. Yet, hardware write blocking is usually global, but I have some Calluna controllers that allow tailoring of the blocking and access control via intercept of the ATA commands.
But, gosh, that is all at least 10 years old tech.
----- Original Message ----- From: "Daniel J Walsh" dwalsh@redhat.com To: selinux@lists.fedoraproject.org Sent: Tuesday, September 06, 2011 7:04 AM Subject: Re: Monitoring and prevention of MBR activity.
On 09/06/2011 09:51 AM, Robb III, George B. wrote:
Hi All-
Have an interesting problem in which monitoring and preventing activity on the MBR would be very useful.
Has anyone used SELinux for this type of task?
Thanks for any assistance,
George
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
Maybe if I new what MBR stood for?
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
Ok now I recognize it, SELinux can be used to allow/prevent processes from writing to physical disk. For example SELinux can prevent processes including confined administrators that are running as root from writing directly to /dev/sda.
The audit subsystem could be used to watch for processes writing to physical disk. (SELinux could also, but auditing does a better job.
Now if you have a app/admin user process that needs to have full access to the system but want to make sure he does not modify the MBR you will have a difficult time writing policy for this.
Now if you have a app/admin user process that needs to have full access to the system but want to make sure he does not modify the MBR you will have a difficult time writing policy for this.
Not to mention that there are some tools - parted being one - which need access (rw) to that sector of the hdd, regardless of who runs these tools.
Hi All- Wonderful information and good thread. Thanks!
We have a piece of vendor code that is replicating several fiber attached LUNs. We believe there is a software has a mis-configuration causing /dev/sda vs /dev/sdaa (one of the many LUNS) to have its MBR zeroed.
SELinux seems like an appropriate tool to at least monitor access if not allow full blocking.
Write protection is not an option as its a PERC controller and /dev/sda is the boot mirror (unless there are known alternatives)?
Thanks again all,
George
On Tue, Sep 6, 2011 at 10:06 AM, Mr Dash Four mr.dash.four@googlemail.comwrote:
Now if you have a app/admin user process that needs to have full access to the system but want to make sure he does not modify the MBR you will have a difficult time writing policy for this.
Not to mention that there are some tools - parted being one - which need access (rw) to that sector of the hdd, regardless of who runs these tools.
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
selinux@lists.fedoraproject.org