funsec mailing list archives

Re: grannyx


From: Drsolly <drsollyp () drsolly com>
Date: Mon, 28 Aug 2006 17:09:57 +0100 (BST)

Oh bugger.

Then it's going to have to be "write to pen drive."

On Mon, 28 Aug 2006 Valdis.Kletnieks () vt edu wrote:

On Mon, 28 Aug 2006 14:21:54 BST, Drsolly said:
I just checked the knoppix site. Version 5 lets you write to NTFS systems; 
that was the main barrier to grannyx before. So maybe it's time to revive 
the project.

Check carefully - the in-tree NTFS in the 2.6 kernel still, AFAIK, has
some restrictions on writing.  In particular, I think it's able to write
to existing files, but is *not* able to create new ones - which is still
a show-stopper.  In the 2.6.18-rc4-mm3 kernel tree (ie very bleeding edge):

#ifdef NTFS_RW
        //.dirty_inode  = NULL,                 /* VFS: Called from
        //                                         __mark_inode_dirty(). */
        .write_inode    = ntfs_write_inode,     /* VFS: Write dirty inode to
                                                   disk. */
        //.drop_inode   = NULL,                 /* VFS: Called just after the
        //                                         inode reference count has
        //                                         been decreased to zero.
        //                                         NOTE: The inode lock is
        //                                         held. See fs/inode.c::
        //                                         generic_drop_inode(). */
        //.delete_inode = NULL,                 /* VFS: Delete inode from disk.
        //                                         Called when i_count becomes
        //                                         0 and i_nlink is also 0. */
        //.write_super  = NULL,                 /* Flush dirty super block to
        //                                         disk. */
        //.sync_fs      = NULL,                 /* ? */
        //.write_super_lockfs   = NULL,         /* ? */
        //.unlockfs     = NULL,                 /* ? */
#endif /* NTFS_RW */

So at least erasing an existing file isn't possible.

I haven't checked what voodoo Knoppix is including that lets it do it, but
it's probably the 'captive NTFS' stuff, which has approximately the same
reputation as ndiswrappers, and for the same reasons....


_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.


Current thread: