Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I recently found out that if I edit GRUB before booting and I add rw init=/bin/bash I end up with a root shell.

Being in a condition that I want to understand everything I would like to know why this happens. I mean is it a bug? is it a feature? is it there to help admins to fix things as it only works if you have physical access to a computer?

Is it provided by GRUB or the actual kernel?

share|improve this question

migrated from security.stackexchange.com Mar 18 '12 at 19:39

This question came from our site for Information security professionals.

8  
If you want to "fix" this, lock GRUB and your BIOS with a password and put your hard disk first in boot order. If someone else has physical access and can put the (non-encrypted) hard disk into another computer, you have lost anyway –  jofel Mar 18 '12 at 20:21

5 Answers 5

This is a feature, and is used for system maintainance: it allows a sysadmin to recover a system from messed-up initialization files or change a forgotten password.

This post in the Red Hat mailing list explains some things:

In Unix-like systems, init is the first process to be run, and the ultimate ancestor of all processes ever run. It's responsible for running all the init scripts.

You're telling the Linux kernel to run /bin/bash as init, rather than the system init. [...]

Thus, you are not exploiting anything, you are just using a standard kernel feature.

Besides, as noted in a comment, the rw flag is separate from init=, it just tells the system to mount the root file system as read-write (so you can e.g. edit the misconfigured file or change a password).

share|improve this answer
2  
Also, rw is completely separate from init=. The former just tells the kernel to mount the root filesystem read-write. –  Alexios Mar 18 '12 at 20:20

When the computer starts, it runs a program called "init", usually found at /bin/init or /sbin/init. This program is responsible for all the system startup and creating a usable environment.

Specifying init=/bin/bash tells the kernel to run /bin/bash instead (which is a shell). Specifying rw tells the kernel to boot with the hard disk in read-write mode instead of read-only mode. Traditionally the kernel starts with the disk in read-only mode and a process later on checks the integrity of the disk before switching to read-write.

share|improve this answer

Your system has mechanisms for running and debugging (like the init parameter) and it probably has security mechanisms to stop unwanted users from taking advantage of them. These are features, not bugs.

The bootloader is responsible for starting the OS. OS security obviously doesn't apply at that point. You could just load a different kernel, initrd, root fs or set different options (like init path). If you want to stop users from doing that, it must be done at the bootloader.

Your system (probably a PC, so BIOS) loads the bootloader and so, obviously, bootloader security doesn't apply to it. If you want to stop users from making the bios boot from USB or such, you need to do that on that level.

Your system may be on a desk somewhere. If you want to stop users from opening the coputer and switching the hdd for one of their own or removing the drive to mount it in their machines, you need to do it on a physical level. And it won't stop them from picking up the whole desk and driving away in their getaway van...

That's the way security is. Elephants all the way down.

share|improve this answer
    
Nice summary. Might want to add hdd encryption to that, as a possible answer against the van. –  MvG Aug 2 '13 at 20:56

Pieced together from http://kernel.org/doc/Documentation/kernel-parameters.txt

KNL     Is a kernel start-up parameter.

init=   [KNL]
        Format: <full_path>
        Run specified binary instead of /sbin/init as init
        process.

rw      [KNL] Mount root device read-write on boot
share|improve this answer

This is a feature from the kernel: it allows its “caller”, i.e. the boot loader, great flexibility. Grub provides you with the means to make use of this flexibility while booting, but it also provides you with the means to restrict this kind of tampering. This makes particular sense in those cases where unauthorized users may get hold of the boot process, but are otherwise denied access to the hard drive itself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.