prw-rw-rw /dev/log

prw-rw-rw /dev/log

Post by Andrew Spri » Sat, 24 Feb 1996 04:00:00



I've noticed that the /dev/log on our system is a named pipe, not a device
driver.  Is that common and/or safe?

Can't anyone who wants to just
   cat /dev/log > /dev/null &
and 'suck the pipe dry', so to speak?

--
Where a calculator on the ENIAC is equipped with 18,000
vacuum tubes and weighs 30 tons, computers in the future
may have only 1,000 vacuum tubes and weigh only 1/2 tons.
            Popular Mechanics, March 1949

<http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0x...>

 
 
 

prw-rw-rw /dev/log

Post by David Malo » Mon, 26 Feb 1996 04:00:00



>Can't anyone who wants to just
>   cat /dev/log > /dev/null &
>and 'suck the pipe dry', so to speak?

This would be a problem if something wasn't connected to it,
but syslogd should more or less always be ? Of course that
does not make it secure....

        David.

 
 
 

1. flexlm on HPs requires rw-rw-rw- on /dev/lan0



  [ First off, tell them to type
  % uname -a
  HP-UX roissy A.09.01 A 9000/710 2000058403 two-user license
                                  ^^^^^^^^^^
  and look at this number.  HP says it is unique per machine and will
  stay the same if HP replaces your board.  They don't make the same
  claim about your ethernet address.
  ]

HP doesn't support promiscuous mode through /dev/lan0, so you cannot
eavesdrop on the net as a whole.  You can't send ethernet frames that
look like they came from a different computer.  You can't send or receive
ethernet frames with a type field that is in use by some other thing
in your computer, so you can't spoof IP because the kernel has already
claimed that protocol-type for itself.  You can't reset the interface
unless you are root.  [This is all determined from a machine that
*doesn't* have the STREAMS add-on.]

Now for the security holes:

If there is *any* protocol in use on your network that your HP box is
*not* using, that protocol can be spoofed from your machine through the
/dev/lan0 interface.  This could mean Novell or DECNET or it could just
mean gobs of broadcast packets containing the string "YADDA YADDA YADDA".

Don't forget that routers often are set up to forward more than just
IP packets.  For example, the network here also forwards IPX packets,
so I could use my HP to attack a Novell machine on the other side of
the campus, if I was willing to implement Novell protocols as user
level code.

2. Game Development Help

3. I want FTP default to be -rwxrwxrwx files, NOT system default like -rw-rw-rw- files !

4. Reading is much more interesting than TV (0080/1708)

5. A SIMPLE SHELL PROGRAM CHANGE /etc/passwd mode to -rw-rw-rw-

6. 2 graphic boards in a Linux box

7. File permission set to -rw-rw-rw-?by Apache/CGI?

8. Even Parity enable on Linux terminal driver???

9. Summary: ftpd from SunOS 4.1.3 creates files with rw-rw-rw

10. I want FTP default to be -rwxrwxrwx files, NOT system default like -rw-rw-rw- files !

11. vi (Re: =-> Is /tmp: -rw-rw-rw- root system" a risc?)

12. ftpd from SunOS 4.1.3 creates files with rw-rw-rw

13. broken 2.2 IDE CD-RW (was Re: plain 2.2.X: no ide CD-RW?)