I've been looking for solutions for Linux that can disable/deny attempts to write directly to block devices—preferably only certain ones like the boot disk (as with Apple's SIP)—while still permitting writes at the filesystem-level.

grsecurity is the first project I found that had this solution and is where I'm getting the idea from. The trouble with theirs is that I don't need (nor care for) the rest of what it provides and that it is too sweeping. Any block device that is mounted read-only or is unmounted will itself be made read-only (i.e., you can't run dd if=/dev/zero of=/dev/sda1) and they can't be (re)mounted read-write if they are like that at the time of activating the protection. Looking at their code, I managed to write a kernel module (and a kernel patch with a one-way sysctl entry) that did the same thing. I later modified the kernel module to only block raw write operations to /dev/sda and /dev/sda1 based on name. Then, I rewrote it again to only block writes based on major number since I didn't know how to handle non-canonical paths.

I abandoned the kernel because a module is so much easier, but it would be even easier if I knew how to write code that could determine the boot device and its parent so I don't have to hard code the numbers. So, I've resorted to searching for a solution with Google as I figured it would be a common idea (without the targeting of the boot disk). My results have only been about raw devices, write blockers for forensics, and raw IO as it relates to memory. What would be the terminology that is used to describe a system that prohibits writing directly to data storage devices?

  • I'm not sure what terminology you should use to search, but it sounds like something you could implement as policy. Maybe cgroups (blkid) can help you. However, direct access to block devices usually requires root privileges. If you explain more about what you are trying to accomplish and why that restriction is insufficient, someone might be able to better point you in the right direction. – Paul Nordin Aug 25 '16 at 20:18
  • @PaulNordin Look at the top where I reference SIP. – Melab Aug 25 '16 at 22:50
  • 1
    OpenBSD had this feature (as part of securelevel 2) a decade or so earlier. – Gilles 'SO- stop being evil' Aug 25 '16 at 22:51
  • I can't think of any other name than “raw write to a block device”. – Gilles 'SO- stop being evil' Aug 25 '16 at 22:52
  • @Gilles I am aware of securelevel and I tried implementing it, but it was too sweeping. I need it to work like SIP. – Melab Aug 25 '16 at 22:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.