Subject: Re: new kpi proposal, sysdisk(9)
To: Jason Thorpe <thorpej@shagadelic.org>
From: David Laight <david@l8s.co.uk>
List: tech-security
Date: 01/03/2007 21:06:18
On Tue, Jan 02, 2007 at 07:16:53PM -0800, Jason Thorpe wrote:
> 
> On Jan 2, 2007, at 3:06 PM, David Laight wrote:
> 
> >The MBR extended partition is a linked list, not a tree, and is  
> >(IMHO as
> >well) treated if it were just a method of splitting a large chunk of
> >disk into pieces.
> 
> Well, it's a tree in the sense that each partition itself can have  
> nested partitions, so you can think of the top-level MBR the  
> "trunk" (with 4 leaves/branches), and the first MBR sector as being  
> the "root".  That is, unless I fundamentally misunderstand how it  
> works :-)

It appears to be like that at first, but in fact each of the 'extended
partitions' is only allowed to have 2 entries - one data ptn and the next
extended one.  The data ptn is defined relative to the current 'extended
ptn' (ie has offset 63), whereas each extended ptn is defined relative to
the outer extended ptn.

	David

-- 
David Laight: david@l8s.co.uk