Re: Permission denied exporting whole device

[Alex Bligh <alex@alex.org.uk>]

> On 1 Jan 2018, at 16:25, g <sendmailtogoran@gmail.com> wrote:
> 
> Am Montag, den 01.01.2018, 16:05 +0000 schrieb Alex Bligh:
>> Can a non-root user even read /dev/sdb?
> 
> No, but nbd-server runs as user nbd. If I change it, what will happen regarding
> security?

You need to ensure that the user that nbd runs as can access /dev/sdb if you want it to be able to export it.

The easiest way to do this would be (per Shaun's comment) to add user nbd to the disk group (assuming disk owns /dev/sdb which would be normal). The biproduct of this is that the nbd daemon would be able to read/write all raw disks (and anything else owned by user/group disk), so in the event of a vulnerability in nbd this might give a route to privilege escalation (for instance it could manually edit /etc/shadow).

-- 
Alex Bligh