• Re: Write protection on SD cards

    From mcanswer@mcanswer.pl@110:300/1.1 to All on Sat Dec 17 07:51:41 2011
    G]ther Schwarz <strap@gmx.de> writes:

    Tobias Blass wrote:

    On 2011-11-01, G]ther Schwarz <strap@gmx.de> wrote:
    the attacker could (root access provided) e.g. load a kernel
    module or install another kernel that does not check the write
    protection switch.

    You understood that correctly. The device is supposed to survive in a
    clean state in case the systems gets compromised and thus allow for a
    fresh installation without having to insert a CD or doing a PXE boot. It should be better in this respect than an extra partition on the main hard disk. But still the security needs are moderate.

    You can always use some mandatory access control preventing attacker
    from access to this device and/or from load kernel modules.
    The first one could be done by SeLinux or RBAC,
    second one by for ex. GrSecurity

    --- MBSE BBS v0.95.13 (GNU/Linux-x86_64)
    * Origin: ICM, Uniwersytet Warszawski (110:300/1.1@linuxnet)
  • From =?iso-8859-1?q?G=FCnther?= Schwarz@1:0/0 to All on Sat Dec 17 17:32:22 2011
    mcanswer wrote:

    G]ther Schwarz <strap@gmx.de> writes:

    Tobias Blass wrote:

    On 2011-11-01, G]ther Schwarz <strap@gmx.de> wrote:
    the attacker could (root access provided) e.g. load a
    kernel
    module or install another kernel that does not check the write
    protection switch.

    You understood that correctly. The device is supposed to survive in a
    clean state in case the systems gets compromised and thus allow for a
    fresh installation without having to insert a CD or doing a PXE boot.
    It should be better in this respect than an extra partition on the main
    hard disk. But still the security needs are moderate.

    You can always use some mandatory access control preventing attacker
    from access to this device and/or from load kernel modules. The first
    one could be done by SeLinux or RBAC, second one by for ex. GrSecurity

    These are all very useful in protecting a running system. But then my
    question was if a SD might be considered as reasonably safe in a scenario where an uncontrolled system an kernel are running. Just think of a bug
    or a misconfiguration in the BIOS setup which allows for booting from a
    CD or USB device instead from the hard disk.

    G]ther

    --- MBSE BBS v0.95.13 (GNU/Linux-x86_64)
    * Origin: The Kofo BBS MBSE - telnet://fido1.kofobbs.ne