ggm@brolga.cc.uq.oz.au (George Michaelson) (03/18/91)
If you have some files in a directory eg /usr (on the root partition)
and you mount the filesystem /usr over them, they become "invisible".
How "invisible" are they? Can this be exploited meaningfully by sysops
or others to provide secure online storage of files you don't want
mortals to know about? (/usr is a bad example. unmounting makes the
system pretty useless. some other places might be more bearable.)
-george
--
G.Michaelson
Internet: G.Michaelson@cc.uq.oz.au Phone: +61 7 365 4079
Postal: George Michaelson, the Prentice Centre,
The University of Queensland, St Lucia, QLD Australia 4072. duplain@rtf.bt.co.uk (Andy Duplain) (03/19/91)
In article <1991Mar18.045734.5114@brolga.cc.uq.oz.au> ggm@brolga.cc.uq.oz.au (George Michaelson) writes: > >If you have some files in a directory eg /usr (on the root partition) >and you mount the filesystem /usr over them, they become "invisible". > >How "invisible" are they? Can this be exploited meaningfully by sysops >or others to provide secure online storage of files you don't want >mortals to know about? (/usr is a bad example. unmounting makes the >system pretty useless. some other places might be more bearable.) No, they can't be used until you umount the filesystem. We recently had a problem with our root disk space; we couldn't find out what was using it all up. Then we realised that we had been very considerate and taken a copy of an old kernel, after a rebuild. Unfortunetly we backed-up the kernel to /tmp, which wasn't mounted at the time. Took ages to find the problem... take heed. -- === Andy Duplain ============================================================== British Telecommunications PLC, Customer Systems, Brighton, United (?) Kingdom. #define DISCLAIMER My views and options are not necessarily those of my company Internet: duplain@rtf.bt.co.uk UUCP: ...!uunet!ukc!axion!bscsq1!duplain
sahayman@porbeagle.cs.indiana.edu (Steve Hayman) (03/21/91)
> [files hidden under a mount point] can't be used until you umount > the filesystem. Actually you can get at them if you mount the file system which really contains the hidden files by NFS, and then look around via NFS. i.e. you have directory /foo on machine blurfl and file /foo/hidden; you mount some device on top of /foo and now you can't get to /foo/hidden any more - BUT - if you nfs-mount blurfl:/ somewhere else, let's say /nfs/blurfl, then you can quite easily get to /nfs/blurfl/foo/hidden. NFS conveniently doesn't follow remote mount mount points so it just breezes right past the foo directory. I assume this works on other machines, but I've only tried it under SunOS 4.1. Steve -- Steve Hayman Workstation Manager Computer Science Department Indiana U. sahayman@iuvax.cs.indiana.edu (812) 855-6984 NeXT Mail: sahayman@spurge.bloomington.in.us
tchrist@convex.COM (Tom Christiansen) (03/21/91)
From the keyboard of Steve Hayman <sahayman@porbeagle.cs.indiana.edu>: :I assume this works on other machines, but I've only tried it :under SunOS 4.1. Works on a Convex -- I sure use it. --tom
jeffl@NCoast.ORG (Jeff Leyser) (03/22/91)
In post <1991Mar18.045734.5114@brolga.cc.uq.oz.au>, ggm@brolga.cc.uq.oz.au (George Michaelson) says: ! !If you have some files in a directory eg /usr (on the root partition) !and you mount the filesystem /usr over them, they become "invisible". ! !How "invisible" are they? Can this be exploited meaningfully by sysops !or others to provide secure online storage of files you don't want !mortals to know about? (/usr is a bad example. unmounting makes the !system pretty useless. some other places might be more bearable.) They're completely invisible, at lease to all "useful" utilities. The only way to manipulate the "hidden" would be by i-node numbers, and I don't think anything other than fsdb will be able to do that for you. Of course, unmounting the "overlay" will allow you to manipulate the (no longer) hidden files in the usual manner. But there several better ways to do what (I think) you want. Place the files in a directory owned by root, with permission of 700. Users will see the existence of the directory, but won't be able to tell what is inside. If you want to go one step further, and hide the directory name, place the "good" directory inside a dummy directory, and set the dummy to 700, too. This isn't very internal-ish. Followup to comp.unix.questions, please. -- Jeff Leyser jeffl@NCoast.ORG
tomas@u30003.rsv.svskt.se (Tomas Ruden) (03/22/91)
In article <1991Mar19.100615.13770@rtf.bt.co.uk> duplain@rtf.bt.co.uk (Andy Duplain) writes: > > No, they can't be used until you umount the filesystem. We recently had a > problem with our root disk space; we couldn't find out what was using it all > up. Then we realised that we had been very considerate and taken a copy > of an old kernel, after a rebuild. Unfortunetly we backed-up the kernel to > /tmp, which wasn't mounted at the time. Took ages to find the problem... > take heed. > I have seen similar thing done on purpose. It was on a Unisys 5000/85 with Unix V.3 (don't remember the release). On the root filesystem there was a tiny little /usr-tree. It was just enogh files to make the system useable without any mounts. When the system was brought to multiuser, the real /usr filesystem was mounted and the small one was hidden by the real one. I found that quite useful. -- Tomas Ruden, ...!sunic!u30003!tomas or tomas@u30003.rsv.svskt.se Don't blame the Swedish Tax ! I wish I had an English Administration for my opinions ! spellingchecker
mouse@thunder.mcrcim.mcgill.edu (der Mouse) (03/26/91)
In article <1991Mar20.131908.18569@news.cs.indiana.edu>, sahayman@porbeagle.cs.indiana.edu (Steve Hayman) writes: >> [files hidden under a mount point] can't be used until you umount >> the filesystem. > Actually you can get at them if you mount the file system which > really contains the hidden files by NFS, and then look around via > NFS. True, and I maintain this is a bug (or at best a misfeature) in NFS. This is one thing Irix got right; they have an option "nohide" (I forget just where one applies it) which results in local disk mounts being seamless when seen via NFS. I don't say it should be the default, but I definitely think it should be available. der Mouse old: mcgill-vision!mouse new: mouse@larry.mcrcim.mcgill.edu