From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.71) id 1U7mmH-000656-5c for mharc-grub-devel@gnu.org; Tue, 19 Feb 2013 07:58:33 -0500 Received: from eggs.gnu.org ([208.118.235.92]:52276) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U7mm3-00062o-MF for grub-devel@gnu.org; Tue, 19 Feb 2013 07:58:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1U7mlr-0006VN-Ug for grub-devel@gnu.org; Tue, 19 Feb 2013 07:58:19 -0500 Received: from dgate20.ts.fujitsu.com ([80.70.172.51]:37780) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1U7mlr-0006U8-GE for grub-devel@gnu.org; Tue, 19 Feb 2013 07:58:07 -0500 DomainKey-Signature: s=s1536a; d=ts.fujitsu.com; c=nofws; q=dns; h=X-SBRSScore:X-IronPort-AV:Received:X-IronPort-AV: Received:Message-ID:Date:From:Organization:User-Agent: MIME-Version:To:Subject:References:In-Reply-To: X-Enigmail-Version:Content-Type:Content-Transfer-Encoding; b=huXtGbFjsSk7J4EQK9KmGhhHeCbAmFYpS7YRzF3jDjL+AetCH2pmKZzX mfwZPB8TqTLcheGp2Gienb0nbO56ytI8YJ3KU+X449ImQdLGyYCpOgiwU 4Qkq1UegkfR2nHnp5WE1JstAZIM19eNjIiFVOEqwQQI9ubuF/Havq7i1M rF1LSWlMk4G+6RnbCDRzys+BhSssAMs1rWy7TPPD1VOGxRVPPkACyM7iD 0yeuxfrIczwDhVSHcCRMUjrrVqajI; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=ts.fujitsu.com; i=@ts.fujitsu.com; q=dns/txt; s=s1536b; t=1361278687; x=1392814687; h=message-id:date:from:mime-version:to:subject:references: in-reply-to:content-transfer-encoding; bh=pNIBv7n3kdxAg9Nm6VekvKTZlAqvQJXNXugoRlDafyc=; b=W0jKvPl8vf9sBZ8ZfSVbiaoLE5gALFivLclP0cuxKgHZrLaWBEVvRsi7 emd3tTkvG4HU7xhghrYG3yM4VAzCdrCH8a811WYjwtvhMzSEHdn0OGTFp 8H2VAyznIJkNpQl/1sVB0taHq+4ZvSvaPdqQu1sjnM3MtaAL1Qx/Mxue4 ZmB04XBtbw67nuoS5uHtv6uA57gDGTQRxOsGn3AbaJoWtFAI96ESdNZMD 8zNaaarXdkTjzNgsqsIHlKZp7jumq; X-SBRSScore: None X-IronPort-AV: E=Sophos;i="4.84,695,1355094000"; d="scan'208";a="116475878" Received: from unknown (HELO abgdgate60u.abg.fsc.net) ([172.25.138.90]) by dgate20u.abg.fsc.net with ESMTP; 19 Feb 2013 13:58:04 +0100 X-IronPort-AV: E=Sophos;i="4.84,695,1355094000"; d="scan'208";a="55009990" Received: from unknown (HELO cooper.psw.pdbps.fsc.net) ([172.25.253.64]) by abgdgate60u.abg.fsc.net with ESMTP; 19 Feb 2013 13:58:03 +0100 Message-ID: <512376DB.6000908@ts.fujitsu.com> Date: Tue, 19 Feb 2013 13:58:03 +0100 From: Martin Wilck Organization: Fujitsu Technology Solutions User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130110 Thunderbird/17.0.2 MIME-Version: 1.0 To: grub-devel@gnu.org Subject: Re: GRUB and the risk of block list corruption in extX References: <51138645.4050405@ts.fujitsu.com> <51153345.2020509@ts.fujitsu.com> <0088990F-66E5-4F51-A9C4-3BD8963A6DA0@colorremedies.com> <512261FE.2090604@ts.fujitsu.com> <512347F2.4070901@gmail.com> In-Reply-To: <512347F2.4070901@gmail.com> X-Enigmail-Version: 1.5.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.70.172.51 X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: The development of GNU GRUB List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Feb 2013 12:58:31 -0000 Vladimir, thanks for your thoughtful answer. I understand your concerns better now. On 02/19/2013 10:37 AM, Vladimir 'φ-coder/phcoder' Serbinenko wrote: > Suppose blocklist changes because of e.g. user mistake. Yet at the old > location there is still the old core.img. For the time being. So this > problem may go unnoticed for years yet if someone has the ability to > create new files on the disk in question, he creates ton of files with > copies of malicious sector, one of them will overwrite core and be > executed on next reboot. Am I understanding correctly that the user mistake you describe must be some manipulation of "core.img" itself (e.g. running grub2-mkimage but now grub2-setup, which would classify as "mistake" in a blocklist setup)? Martin -- Dr. Martin Wilck PRIMERGY System Software Engineer x86 Server Engineering FUJITSU Fujitsu Technology Solutions GmbH Heinz-Nixdorf-Ring 1 33106 Paderborn, Germany Phone: ++49 5251 525 2796 Fax: ++49 5251 525 2820 Email: martin.wilck@ts.fujitsu.com Internet: http://ts.fujitsu.com Company Details: http://ts.fujitsu.com/imprint