0

I read this in "RH413 Red Hat Server Hardening" course that we mount the filesystems with nodev which then does not allow the special files/devices to be mounted from it. However, it did not show an example.

I, however, did the following thing on my RHEL machine and I found that we cannot associate the special character device with any file created by dd command when the filesystem is mounted with nodev option. I later removed nodev option and was able to associate the character device with the newly created file with dd command.

Is this the behaviour which is expected when we mount an FS with nodev option or is there something else which I'm missing?

Here go the commands:

[root@server Special]# mount | grep /Special
/dev/mapper/home on /Special type ext4 (rw,nodev,relatime,seclabel,data=ordered)
[root@server Special]#

[root@server Special]# ls -l
total 16
drwx------. 2 root root 16384 Feb 20 01:40 lost+found
crw-r--r--. 1 root root  1, 5 Feb 21 04:53 spFile
[root@server Special]#

[root@server Special]# dd if=spFile of=newDev bs=1K count=20000
dd: failed to open ‘spFile’: Permission denied
[root@server Special]#

Removed nodev by adding exec.

[root@server ~]# mount | grep /Special
/dev/mapper/home on /Special type ext4 (rw,relatime,seclabel,data=ordered)
[root@server ~]# 

[root@server Special]# dd if=spFile of=newDev bs=1K count=20000
20000+0 records in
20000+0 records out
20480000 bytes (20 MB) copied, 0.527708 s, 38.8 MB/s
[root@server Special]#

[root@server Special]# ls -l
total 20016
drwx------. 2 root root    16384 Feb 20 01:40 lost+found
-rw-r--r--. 1 root root 20480000 Feb 21 05:10 newDev
crw-r--r--. 1 root root     1, 5 Feb 21 04:53 spFile
[root@server Special]#

[root@server Special]# mkdir /spDev
[root@server Special]# mount newDev /spDev/

[root@server Special]# df -h /spDev/
Filesystem      Size  Used Avail Use% Mounted on
/dev/loop0       18M  326K   17M   2% /spDev
[root@server Special]#
1

Firstly...

I found that we cannot associate the special character device with any file created by dd command

The experiment you have shown does not create a file with dd, it tries to write to a special character device using dd.


1) What are device files?

Device files can be thought of as a link to a device in your kernel. While they are stored on disk, the actual device they describe is nothing to do with the file system are stored on. In that regard think of them similar to a symbolic link that points to something inside the kernel.

The file name is irrelevant; just as a symbolic link can be named anything and put anywhere, so a device file can be named anything and stored anywhere it will still point to the same device.

2) Why are they a security problem?

For obvious reason, not just anyone can connect to a device directly. For example, you don't want a regular user just reading your hard drive, ignoring the file system and its permissions.

If you plug a drive into your machine and just mount it, there is a risk that there are device files on that disk with in-secure permissions. These might point to something that is supposed to be secured. So by plugging the disk in, you might give someone access to a device by mistake.

3) What does nodev do?

This plugs the security hole. It tells the operating system to ban any program from accessing a device through a device file stored on this file system.

In your experiment you used DD to try to write to a device using a device file (link to that device). Because in the first case you mounted with nodev the OS banned dd (and every other program) from using that device file.


Edit: A little more on device files

Above I mentioned that device files are similar to symbolic links. For device files, the major and minor numbers are used to specify what they link to. If we take an example that's been automatically created by the opperating system:

$ ls -l /dev/zero /dev/random /dev/sda /dev/sda1
crw-rw-rw- 1 root root 1, 8 Feb 16 23:24 /dev/random
brw-rw---- 1 root disk 8, 0 Feb 16 23:24 /dev/sda
brw-rw---- 1 root disk 8, 1 Feb 16 23:24 /dev/sda1
crw-rw-rw- 1 root root 1, 5 Feb 16 23:24 /dev/zero

So on my system, if I call mknod foo c 1 8 I should end up with a character device identical to /dev/random. To be clear, it's the same device, just a different file pointing to it.

According to the printout in your question it has major number 1 minor number 5. On my system, that's /dev/zero.

  • Thanks for the answer Philip. I now got the idea of the device files. So when I created a character device file by mknod, so did it reference some already created character device in kernel? And can you further elaborate this: The experiment you have shown does not create a file with dd, it tries to write to a special character device using dd. – root Feb 21 at 14:40
  • @root See my edit. – Philip Couling Feb 21 at 15:00
  • Great Philip. Thanks for your time. So the new device file will be a new link to the same block/character device. Indeed, it points to /dev/zero on my system also. – root Feb 21 at 15:09
0

nodev just means that device nodes on that filesystem don't work. They can exist from before, and you can create them, but you can't open them.

# mount -ttmpfs -onodev tmpfs /tmp/test
# cd /tmp/test/
# cp -a /dev/sda .
# ls -l
total 0
brw-rw---- 1 root disk 8, 0 Dec 16 18:24 sda
# head -c512 ./sda | od -c
head: cannot open './sda' for reading: Permission denied

That's the same as when you tried to open spFile. Of course it does work if you remove nodev. (exec has nothing to do with this, it controls executing programs off the filesystem, a different thing.)

# mount -oremount,dev .
# head -c512 ./sda |od -c
0000000 372 270  \0 ...

As for what you mean with "associating the special character device with a file created by dd", I have no idea what you mean with it.

  • Thanks for the snippet ilkkachu. As what i meant by associating with a device with a file created by device was to write from that special device file spFile to newDev – root Feb 21 at 14:50
  • So, any other user will not b able to copy/read/write the block device. [aamir@server ~]$ cp -a /dev/sda /Special cp: cannot create special file ‘/Special/sda’: Permission denied – root Feb 21 at 15:10
  • @root, yeah, you need to be root (or have the appropriate capabilities) to create device nodes. But that's not related to nodev – ilkkachu Feb 21 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.