Re: no deprecation of /usr as a standalone filesystem
On Mon, 01 Jun 2009, Pierre Habouzit wrote:
> Think again, if I do such a package, I would obviously check with some
> kind of trivial perl programm if the device containing /usr/lib/rootkit
> is mounted with nodev, would use mount -o remount,dev on the problematic
> mount point in the preinst, let the unpacking happen, and remount
> properly in the postinst.
AFAIK, nodev blocks device nodes from _WORKING_ as well.
Anyway, one would need to just remount it "dev" as root to exploit.
Of course, when you have el-crap-o pathbased security plus something locking
down remounts, the above is an attack vector that separate /usr could close.
Not something someone using SE Linux would need to care about, though.
> And if you really care about those extra bits of performance, then what
> I'd do is _not_ to not encrypt /usr but rather to let / be unencrypted,
And now you need /etc as a separate partition, which is a lot worse to pull
off than /usr as a separate partition...
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: