[PATCH] Mountpoint detection for removable devices
Vratislav Podzimek
vpodzime at redhat.com
Wed Nov 19 07:16:41 UTC 2014
On Tue, 2014-11-18 at 19:38 +0100, Vojtěch Trefný wrote:
> Dne 18.11.2014 v 18:50 David Lehman napsal(a):
> > On 11/18/2014 11:07 AM, Vojtech Trefny wrote:
> >> ---
> >>
> >> Removable devices are mounted with '-o nodev' by default.
> >
> > Really? I thought nodev was only for things like tmpfs and proc where
> > there is no backing device.
>
> It is some sort of security feature. It is possible to create a special
> device on filesystem, mount it and use it to access files outside
> chroot. (I don't fully understand the mechanism of this attack but
> adding nodev option seems to be common security advice not only for
> removable drives.)
Yes, IIRC the 'nodev' mount option just means you cannot create devices
(mknod) under that particular filesystem.
--
Vratislav Podzimek
Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic
More information about the anaconda-patches
mailing list