[PATCH] Mountpoint detection for removable devices

Vratislav Podzimek vpodzime at redhat.com
Wed Nov 19 07:16:41 UTC 2014


On Tue, 2014-11-18 at 19:38 +0100, Vojtěch Trefný wrote:
> Dne 18.11.2014 v 18:50 David Lehman napsal(a):
> > On 11/18/2014 11:07 AM, Vojtech Trefny wrote:
> >> ---
> >>
> >> Removable devices are mounted with '-o nodev' by default.
> >
> > Really? I thought nodev was only for things like tmpfs and proc where 
> > there is no backing device.
> 
> It is some sort of security feature. It is possible to create a special 
> device on filesystem, mount it and use it to access files outside 
> chroot. (I don't fully understand the mechanism of this attack but 
> adding nodev option seems to be common security advice not only for 
> removable drives.)
Yes, IIRC the 'nodev' mount option just means you cannot create devices
(mknod) under that particular filesystem.

-- 
Vratislav Podzimek

Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic



More information about the anaconda-patches mailing list