Monday, September 14, 2020

Re: Must disable /usr/libexec/security on backup disks

On Mon, 14 Sep 2020 13:40:03 +0200, Ingo Schwarze wrote:

> I think that is an interesting idea. That would be the patch below.
> Given that the function find_special_files() looks for SUID, SGID,
> and device files, i suggest this logic: skip a mount point if any
> of the following is true:
>
> - it does not have the "local" mount option
> - or it has both the "nodev" and the "nosuid" mount options
>
> I don't think explicitly matching the parentheses is needed.
> The code below is simpler and possibly even more robust.

I like it. The other idea I had was to simply declare that mounts
under a certain directory (such as /mnt) would not be checked, but
I think this is a more elegant approach.

- todd

No comments:

Post a Comment