The Unix Heritage Society mailing list
 help / color / mirror / Atom feed
From: ron@ronnatalie.com (Ron Natalie)
Subject: [TUHS] directories going away.
Date: Thu, 27 Apr 2017 15:03:07 -0400	[thread overview]
Message-ID: <012501d2bf88$e8611660$b9234320$@ronnatalie.com> (raw)

The JHU version of the V6 kernel and the mount program were modified (or
should I say buggered) so that unprivileged users could mount user packs.
There were certain restrictions added as well:   no setuid on mounted
volumes etc.

The problem came up that people would mount them using relative paths and
the mtab wouldn't really show who was using the disk as a result.    I
suggested we just further bugger it by making the program chdir to '/dev'
first.   That way you wouldn't have to put /dev/ on the drive device and
you'd have to give an absolute path for the mount point (or at least one
relative to /dev).    I pointed out to my coworker that there was nothing in
/dev/ to mount on.    He started trying it.   Well the kernel issued errors
for trying to use a special file as a mount point.   He then tried "."
Due to a combination of bugs that worked!

The only problem, is how do you unmount it?   The /dev nodes had been
replaced by the root of directory of my user pack.    Oh well, go halt and
reboot.

There were supposed to be protections against this.   Mind you I did not
have root access at this point (just a lowly student operator), so we
decided to see where else we could mount.    Sure enough cd /etc/ and mount
on "." there.   We made up our own password file.   It had one account with
uid 0 and the name "Game Player" in the gcos field.   About this one of the
system managers calls and tells us to halt the machine as it'd had been
hacked.   I told him we were responsible and we'd undo what we did.

I think by this time Mike Muuss came out and gave me the "mount" source and
told me to fix it.




                 reply	other threads:[~2017-04-27 19:03 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='012501d2bf88$e8611660$b9234320$@ronnatalie.com' \
    --to=ron@ronnatalie.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).