[PATCH] Mountpoint detection for removable devices

Vojtěch Trefný vtrefny at redhat.com
Tue Nov 18 18:38:40 UTC 2014


Dne 18.11.2014 v 18:50 David Lehman napsal(a):
> On 11/18/2014 11:07 AM, Vojtech Trefny wrote:
>> ---
>>
>> Removable devices are mounted with '-o nodev' by default.
>
> Really? I thought nodev was only for things like tmpfs and proc where 
> there is no backing device.

It is some sort of security feature. It is possible to create a special 
device on filesystem, mount it and use it to access files outside 
chroot. (I don't fully understand the mechanism of this attack but 
adding nodev option seems to be common security advice not only for 
removable drives.)

>
>>
>>   blivet/devicetree.py | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/blivet/devicetree.py b/blivet/devicetree.py
>> index 7f3f73a..543eb44 100644
>> --- a/blivet/devicetree.py
>> +++ b/blivet/devicetree.py
>> @@ -2492,6 +2492,8 @@ class DeviceTree(object):
>>                       break
>>           elif options and "nodev" in options.split(","):
>>               device = self.getDeviceByName(devspec)
>> +            if not device:
>> +                device = self.getDeviceByPath(devspec)
>>           else:
>>               if not devspec.startswith("/dev/"):
>>                   device = self.getDeviceByName(devspec)
>>
>
> _______________________________________________
> anaconda-patches mailing list
> anaconda-patches at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/anaconda-patches



More information about the anaconda-patches mailing list