Re: dynamic /dev security hole?

Michael Buesch
2004-08-09T15:36:08Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoting Eric Lammerts <eric@lammerts.org>:
> Just an idea for a fix for this problem: If udev would change the
> permissions to 000 and ownership to root.root just before it unlinks
> the device node, the copy would become useless.

Like this?
Only compile tested against glibc.

===== udev-remove.c 1.31 vs edited =====
- --- 1.31/udev-remove.c 2004-04-01 04:12:56 +02:00
+++ edited/udev-remove.c 2004-08-09 15:23:12 +02:00
@@ -79,6 +79,23 @@
strfieldcat(filename, dev->name);

info("removing device node '%s'", filename);
+ /* first remove all permissions on the device node.
+ * This fixes a security issue. If the user created
+ * a hard-link to the device node, he can't use this
+ * anymore, if we change permissions.
+ */
+ retval = chmod(filename, 0000);
+ if (retval) {
+ info("chmod(%s, 0000) failed with error '%s'",
+ filename, strerror(errno));
+ // we continue nevertheless.
+ }
+ retval = chown(filename, 0, 0);
+ if (retval) {
+ info("chown(%s, 0, 0) failed with error '%s'",
+ filename, strerror(errno));
+ // we continue nevertheless.
+ }
retval = unlink(filename);
if (errno == ENOENT)
retval = 0;

- --
Regards Michael Buesch [ http://www.tuxsoft.de.vu ]

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBF3yMFGK1OIvVOP4RArMrAJ0SvykBehCxPUYPLPIQuGRn3m5eHgCfShXs
e/S0iWzu/qTtDVb1+zp9LRo=
=UsXa
-----END PGP SIGNATURE-----