>>> "Greg" == Greg A Woods <woods@weird.com> writes:

    >> Except that that presupposes write  access to the root filesystem

    Greg> Actually it doesn't, at least not normally.

    Greg> You don't need write access to a filesystem in order to open a device
    Greg> file for write.  The "real" /sbin/init opens /dev/console with O_RDRW
    Greg> well before it starts /etc/rc and so well before the root filesystem can
    Greg> be re-mounted read-write.

No, no. I meant that  replacing /sbin/init with the script presuposses
write access to the filesystem.  The original problem was how (not) to
trick the  kernel into running something  other than the  real init in
order to  bypass an insecure (/etc/ttys) console.   Replacing the real
init with a script works, of course,  but only if you can write to the
disk in the first place.

-w
-- 
William Waites <ww@styx.org>
Idiosyntactix Research Laboratories
http://www.irl.styx.org