On 21/10/14 19:18, Lennart Poettering wrote:
> Well, on some distros lib64 is a symlink on others it isn't. Doesn't
> Debian have /lib/<arch> or so with /lib64 just a symlink to the right
> subdir?
My Debian laptop has /lib64 as a real directory, containing a
ld-linux-x86-64.so.2 symlink into /lib/<multiarch tuple>.
I suspect this might be partly because Debian packages containing other
files or symlinks in /lib64 have existed in the past (e.g. to support
biarch compilers), and if any of those packages have lingered, dpkg is
not going to be happy to replace a non-empty directory with a symlink.
Being able to mount something read-only over /lib64 and /lib also seems
necessary from the ProtectSystem point of view, if you want
ProtectSystem to be a security measure and not just a guard against
accidents, since those two strings are part of the portable ABI for
Linux binaries on various architectures[1]. If a service can overwrite
one of those symlinks with an attacker-chosen value, then it's game over
the next time a binary with the relevant PT_INTERP tag is executed.
It looks as though I was wrong about lib32 not being necessary, it's in
that list too (albeit only for mips and tilegx); so is /libx32.
S
[1] https://sourceware.org/glibc/wiki/ABIList
_______________________________________________
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel
