Re: [Devil-linux-develop] [PATCH] build/scripts/scripts/save-config - security hole?

[Heiko Z. <he...@zu...>]

> On Tuesday 27 April 2004 06:14, Tim Tait wrote:
> [...]
>>
>> While I'm on the topic, I think another pontential hole is the linuxrc
>> script that discovers the etc.tar.bz2 file on boot... since multiple
>> locations are checked, if an unpriveleged user can introduce an
>> etc.tar.bz2 file onto a drive that is checked before the real one, then
>> they can control the machine on the next reboot. We should check the
>> file for "root" ownership and that it is not writeable by anyone else
>> before loading it. Of course not being a bash master I'm not sure how to
>> write that...
> if you have several users on a system, the most dangerous part is
> rebooting.
> it's the only time a false config could be injected, but even worse: just
> pass init=/bin/bash and you have a root shell. So either: don't reboot,
> or:
> always attend your reboots and make sure the right config is loaded.
> If you want to disable command line passing, you have to change
> isolinux.cfg.
> When doing that, you can also add a "config=/dev/whatever" and if you
> protect
> that device properly, everything should be fine.

You can NEVER protect a system when somebody has access to the hardware.
There are endless possibilities on how to gain access....

> of course, make sure no one swaps CD's and boots a rescue system...
> so, IMHO, root ownership may be an additional security check, but it's
> inferior to gpg signing (but maybe we should make that part easier...)

Suggestions on how we can make it easier?
At the moment you only put the public key on the CD and it's working.

I think the signing of the config is the most complicated part, since you
have to get the etc.tar.bz2, sign it and copy the signature to the config
media.

-- 
Regards
  Heiko Zuerker
  http://www.devil-linux.org