Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

if the user has full access to the image file (iso or disk image), will there be any security problem to permit him set up a loopback device backed by this file ?

% ls -al /dev/loop*                                                                                                                                                                  
brw-rw---T 1 root disk  7,   0 Jul 15 16:39 /dev/loop0
brw-rw---T 1 root disk  7,   1 Jun 17 15:58 /dev/loop1
brw-rw---T 1 root disk  7,   2 Jun 17 15:58 /dev/loop2
brw-rw---T 1 root disk  7,   3 Jun 17 15:58 /dev/loop3
brw-rw---T 1 root disk  7,   4 Jun 17 15:58 /dev/loop4
brw-rw---T 1 root disk  7,   5 Jun 17 15:58 /dev/loop5
brw-rw---T 1 root disk  7,   6 Jun 17 15:58 /dev/loop6
brw-rw---T 1 root disk  7,   7 Jun 17 15:58 /dev/loop7
crw------T 1 root root 10, 237 Jun 17 15:58 /dev/loop-control

the loopX is belonged to disk group

% id
uid=1000(user) gid=1000(user) groups=1000(user),6(disk)

I'm in disk group. So, I can use the loopback device

% /sbin/losetup -f ~/disk.img

% /sbin/losetup -a
/dev/loop0: [0809]:2097347 (/home/user/disk.img)

But any user isn't in disk group can't use the loopback device, is there any problem to permit everyone to use the loopback ?

PS: by using mount namespace, any user can mount disks, but the root requirement of loopback device prevent user from mounting disk images.

share|improve this question
    
@goldilocks definitely not, there is no suid or nodev involved by using loopback device. – Zang MingJie Jul 15 '13 at 9:17
    
Alright, I misunderstood what you are looking for here. – goldilocks Jul 15 '13 at 9:26
    
@goldilocks maybe my question title is misleading – Zang MingJie Jul 15 '13 at 9:27
    
Probably not, lol, I just see duplicates too easily. It is a fair and straightforward question. I don't know the answer, unfortunately. Although some of the similar questions about mounting have some suggestions about alternatives to granting privileges, I suppose privileges would be easiest. – goldilocks Jul 15 '13 at 9:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.