file permissions beneath /sys
Hello, i use SystemImager to clone a SuSE 9.2 installation to the other nodes of a small web server farm. The image-retrieval from the golden-client to the imageserver by the SystemImager - Script getimage (in fact using rsync) fails sometimes because of strict file permissions beneath /sys (see list below). As a workaround i make these files readable to root. My question: Is this a severe security breach and should i script something to restore the original settings on every node ? Greetings Uli B. -- _____________________________________________________ Senatsverwaltung für Stadtentwicklung Berlin Informationssystem Stadt und Umwelt Ulrich Brochhagen e-mail: ulrich.brochhagen@senstadt.verwalt-berlin.de http://www.stadtentwicklung.berlin.de/ This mail is written in 100% recycled electrons. _____________________________________________________ --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/AEC62xx_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/ALI15x3_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/AMD_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/ATIIXP_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/CMD64x_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Cypress_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/HPT34x_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/HPT366_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/NS87415_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Opti621_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/PCI_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/PIIX_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Promise_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Promise_Old_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/RZ1000_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/SC1200_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/SIS_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/SLC90e66_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/Serverworks_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/SiI_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/TRIFLEX_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/TRM290_IDE/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/VIA_IDE/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/agpgart-serverworks/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/aic7xxx/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/imsttfb/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/megaide/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/ohci_hcd/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/parport_pc/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/bus/pci/drivers/serial/new_id --w------- 1 root root 4096 Feb 21 16:03 /sys/bus/pci/drivers/tg3/new_id --w------- 1 root root 4096 Feb 21 16:02 /sys/class/scsi_host/host0/scan --w------- 1 root root 4096 Feb 21 16:02 /sys/class/scsi_host/host1/scan --w------- 1 root root 4096 Feb 21 16:02 /sys/devices/platform/host0/0:0:0:0/delete --w------- 1 root root 4096 Feb 21 16:02 /sys/devices/platform/host0/0:0:0:0/rescan --w------- 1 root root 4096 Feb 21 16:02 /sys/devices/platform/host0/0:0:8:0/delete --w------- 1 root root 4096 Feb 21 16:02 /sys/devices/platform/host0/0:0:8:0/rescan
i use SystemImager to clone a SuSE 9.2 installation to the other nodes of a small web server farm. The image-retrieval from the golden-client to the imageserver by the SystemImager - Script getimage (in fact using rsync) fails sometimes because of strict file permissions beneath /sys (see list below). The sys directory contains a virtual filesystem (like /proc). There is no need (it's rather bad!) to copy it.
Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \
Markus Gaugusch schrieb:
i use SystemImager to clone a SuSE 9.2 installation to the other nodes of a small web server farm. The image-retrieval from the golden-client to the imageserver by the SystemImager - Script getimage (in fact using rsync) fails sometimes because of strict file permissions beneath /sys (see list below).
The sys directory contains a virtual filesystem (like /proc). There is no need (it's rather bad!) to copy it.
First thanx for the quick response !! Originaly i excluded the /sys - directory from the retrieval. But when i clone a new node from scratch these files are missing even after a reboot.
Markus
-- _____________________________________________________ Senatsverwaltung für Stadtentwicklung Informationssystem Stadt und Umwelt IXB2/Br Ulrich Brochhagen Webmaster - Internetserver Brückenstr. 6, 10179 Berlin, Raum 4.007 Tel. +49 - 30 - 9025 2125 Fax +49 - 30 - 9025 2520 e-mail: ulrich.brochhagen@senstadt.verwalt-berlin.de http://www.stadtentwicklung.berlin.de/ This mail is written in 100% recycled electrons.
i use SystemImager to clone a SuSE 9.2 installation to the other nodes of a small web server farm. The image-retrieval from the golden-client to the imageserver by the SystemImager - Script getimage (in fact using rsync) fails sometimes because of strict file permissions beneath /sys (see list below).
As a workaround i make these files readable to root.
My question: Is this a severe security breach and should i script something to restore the original settings on every node ?
There is no need to copy the files in /sys at all. They are created by the kernel on boot, so whatever you write, will be gone anyway (like /proc) So just amke sure you create the mount point and the /etc/fstab entry for it. Use '/etc/sysctl.conf' to adjust /proc paramters. /sys is just the 2.6 kernel's extension to /proc.
participants (3)
-
Johannes B. Ullrich -
Markus Gaugusch -
Ulrich Brochhagen