Subject: Re: CVS commit: src/sys/arch
To: Izumi Tsutsui <tsutsui@ceres.dti.ne.jp>
From: Thor Lancelot Simon <tls@rek.tjls.com>
List: tech-security
Date: 11/08/2006 11:31:04
On Thu, Nov 09, 2006 at 01:00:31AM +0900, Izumi Tsutsui wrote:
> tls@rek.tjls.com wrote:
> 
> > Im not sure if it's what you're asking, but we can't allow overwriting
> > of the disklabel at securelevel > 0, because that would allow overwriting
> > any other disk partition, which is forbidden for obvious reasons.
> 
> Overwriting LABELSECTOR via RAW_PART is always allowed, isn't it?

Where this is the case, it is a longstanding bug.  Any operation that
allows the contents of mounted partitions to be modified except through
the filesystem is supposed to be prohibited at securelevel > 0.

Thor