maestro
maestro copied to clipboard
Missing privilege check in the mknod, mount and umount syscalls
According to the man page, the mknod
syscall should return EPERM
when an unprivileged user requests anything except "a regular file, FIFO (named pipe), or UNIX domain socket".
The lack of this check means that an unprivileged user can create a new device node for any connected hard disks to read the entire contents:
mknod foo b 8 0
The mount and umount syscalls should also only be possible to run as a privileged user