Re: Question about security of ioctl's() on raw block devices

Chris Evans (chris@ferret.lmh.ox.ac.uk)
Tue, 19 Aug 1997 11:33:31 +0100 (BST)


On Mon, 18 Aug 1997, Michael L. Galbraith wrote:

> On Mon, 18 Aug 1997, Chris Evans wrote:
> >
> > Here's a probably naive question;
> >
> > If I open a raw fixed disk block device, say /dev/sda or /dev/hda, with
> > the read-only flag, can I still cause a write to disk, or similar, by
> > using a special 'send-command' ioctl, such as HDIO_DRIVE_CMD (ide) or
> > SCSI_IOCTL_SEND_COMMAND (scsi)?
> >
> > Cheers,
> > Chris
>
> As far as I know, raw devices as traditionally sense (/dev/sda vs /dev/rsda)
> don't exist in linux yet. There was a heated discussion concerning the addition
> of these devices into the kernel.. primarily from database folks who what to
> manage their own partitions.. which petered out before any resolution of issues.

Hmmm yes I remember the "discussion" :-) Sorry for using the phrase "raw
block device", I obviously meant "block device".

Anyway my original question still holds; if I have a read-only file
descriptor to my device /dev/hda, which is an IDE disk, can I queue up a
raw IDE command that causes a write, using HDIO_DRIVE_CMD?

If I indeed _can_, then I view this at best as dubious semantics and at
worst a security hole. The fix is obviously trivial; I will provide a
patch if this is deemed to be a problem.

Cheers,
Chris