Debian Bug report logs - #294968
udev: security implications of /.dev

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Henrique de Moraes Holschuh <hmh@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: udev: security implications of /.dev

Date: Sat, 12 Feb 2005 16:49:04 -0200

Package: udev
Version: 0.051-1
Severity: normal

Udev mounts the legacy /dev on /.udev optionally. So far so good. It is a
very handy thing when you need to make sure something will be there before
udev starts.

OTOH, if one does not remember to keep it updated re. permissions, it is a
security liability.

Please move the mount point to inside a root-onwed, 700 directory.  For
example, creating /.udev mode 700, then creating boottime-dev inside it as
the mountpoint for the bind mount.

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (990, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.10-debian5+libata9dev1+bluesmoke
Locale: LANG=pt_BR.ISO-8859-1, LC_CTYPE=pt_BR.ISO-8859-1 (charmap=ISO-8859-1)

Versions of packages udev depends on:
ii  hotplug                  0.0.20040329-16 Linux Hotplug Scripts
ii  initscripts              2.86.ds1-1      Standard scripts needed for bootin
ii  libc6                    2.3.2.ds1-20    GNU C Library: Shared libraries an
ii  makedev                  2.3.1-76        creates device files in /dev
ii  sed                      4.1.4-2         The GNU sed stream editor

-- debconf information excluded

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh

Message #10 received at 294968@bugs.debian.org (full text, mbox, reply):

From: md@Linux.IT (Marco d'Itri)

To: Henrique de Moraes Holschuh <hmh@debian.org>, 294968@bugs.debian.org

Subject: Re: Bug#294968: udev: security implications of /.dev

Date: Sat, 12 Feb 2005 20:27:03 +0100

[Message part 1 (text/plain, inline)]

On Feb 12, Henrique de Moraes Holschuh <hmh@debian.org> wrote:

> OTOH, if one does not remember to keep it updated re. permissions, it is a
> security liability.
Good point. But moving /.dev/ needs to be coordinated with other
packages, so it cannot happen right now.

-- 
ciao,
Marco

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 294968-close@bugs.debian.org (full text, mbox, reply):

From: Marco d'Itri <md@linux.it>

To: 294968-close@bugs.debian.org

Subject: Bug#294968: fixed in udev 0.054-3

Date: Tue, 15 Mar 2005 06:17:03 -0500

Source: udev
Source-Version: 0.054-3

We believe that the bug you reported is fixed in the latest version of
udev, which is due to be installed in the Debian FTP archive:

udev_0.054-3.diff.gz
  to pool/main/u/udev/udev_0.054-3.diff.gz
udev_0.054-3.dsc
  to pool/main/u/udev/udev_0.054-3.dsc
udev_0.054-3_i386.deb
  to pool/main/u/udev/udev_0.054-3_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 294968@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Marco d'Itri <md@linux.it> (supplier of updated udev package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue, 15 Mar 2005 11:55:38 +0100
Source: udev
Binary: udev udev-udeb
Architecture: source i386
Version: 0.054-3
Distribution: unstable
Urgency: high
Maintainer: Marco d'Itri <md@linux.it>
Changed-By: Marco d'Itri <md@linux.it>
Description: 
 udev       - /dev/ management daemon
Closes: 294968 298192
Changes: 
 udev (0.054-3) unstable; urgency=high
 .
   * Do not use udevsend as the hotplug multiplexer on kernels < 2.6.10
     because they generate out of order hotplug events.
   * Use /dev/.static/dev/ instead of /.dev/ to keep the root clean and
     to not leave around devices with possibly insecure permissions.
     This requires raising the versioned dependency on makedev to 2.3.1-77.
     (Closes: #294968)
   * Added upstream patch udev-segfault-DRIVER.patch to fix a segfault when
     matching a non-initialized DRIVER. (Closes: #298192)
   * devfs.rules, udev.rules: added the AOE character devices.
Files: 
 702746f06a0f30609e0c1d1eb3e8c9ef 561 admin extra udev_0.054-3.dsc
 c93d4a5f9a5c200663203ec60521188f 27889 admin extra udev_0.054-3.diff.gz
 ec707811a1cb1cff7a3488cc1c9cfdfd 221342 admin extra udev_0.054-3_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFCNsEzFGfw2OHuP7ERAlsTAJ9DHutt+5wc11N1Ka1NStXHGU1KTgCfQ0fi
3tqvmcigQOgvN9BpBGu/xSU=
=nYO5
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.