Re: Possible forensic issue with grub and RH8.0

From: Stephen Menard (smenardat_private)
Date: Fri Jan 10 2003 - 17:44:05 PST

  • Next message: Christine Siedsma: "CRIME New Digital Forensic resource"

    Glad to know it's not my fault... hit by multiple label conflicts
    
    Have found the same issue with VMware running wirtual disk partion then
    adding real HD partitions RH 8 auto loaded the wrong stuff.
    I went in under single user and made e2fslabel changes and modified the grub
    and /etc/fstab to get around it
    I have since contemplated changing partion labels for mount identification
    purposes.
    must make note.. chande lables or grub and fstab... station customization
    step 11 :-)
    
    this is further evidence for a partition label naming convention that won't
    interfere with drive changes
    
    or HD label party Friday at my neighbor's house ;-)
    
    steve
    On Tue, 07 Jan 2003 19:46:12 PST, Hovis Chasteen <hchasteenat_private>
    said:
    
    > title Red Hat Linux 8.0 (2.4.18-14)
    >  root (hd0,1)
    >  kernel /vmlinuz-2.4.18-14 ro root=LABEL=/
    >  initrd /initrd-2.4.18-14.img
    
    > =
    
    > I am not sure if this is new to 8.0 or grub but I did
    > not see this in RH7.3. If anyone has a better solution
    > or can explain LABEL to me, I=92m all ears.
    
    Basically, LABEL works as follows:  each partition gets a 'label' attached
    to it, and it's stored on the actual partition.  So saying 'LABEL=/usr/foo'
    tells the system "whatever visible partition has that label on it".  It's
    really great for letting you boot even after recabling has changed hda to
    hdc, or if you use LVM or similar and the virtual partition name has been
    changed.
    
    It's hardly news - LILO and 'mount' have supported that for ages.
    
    
    > Greetings,
    >
    > While bench testing a new forensic computer I am
    > working on I noticed a potential problem using RH 8.0
    > with grub.
    >
    > The computer is a P4, 2.4GHz, 1GB ram, 120GB HD loaded
    > with Windows XP, Red Hat 8.0 and grub as the dual boot
    > loader. Nothing special, just out of the box installs.
    >
    > I noticed if I attach another linux bootable drive to
    > the computer (/dev/hdc) when the computer boots, it
    > was trying to load the kernel, root and boot from
    > /dev/hdc not /dev/hda as I expected. I cloned hda and
    > put both in the computer (/dev/hda and /dev/hdc).
    > After reboot I checked /etc/mtab and found that I was
    > in-fact working on /dev/hdc instead of hda.
    >
    > I checked /boot/grub/grub.conf and found the
    > following:
    >
    > title Red Hat Linux 8.0 (2.4.18-14)
    > root (hd0,1)
    > kernel /vmlinuz-2.4.18-14 ro root=LABEL=/
    > initrd /initrd-2.4.18-14.img
    >
    > I changed the kernel line to read "kernel
    > /vmlinuz-2.4.18-14 ro root=/dev/hda5" (hda5 is my root
    > partition). I rebooted the system and everything is
    > now as expected.  My point here is obvious. If I had
    > installed a suspect hard drive on this stock install I
    > could be working on the original evidence and loose
    > data integrity. Not a good thing.
    >
    > I am not sure if this is new to 8.0 or grub but I did
    > not see this in RH7.3. If anyone has a better solution
    > or can explain LABEL to me, I'm all ears.
    >
    > Hovis Chasteen
    >
    
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Sat Jan 11 2003 - 14:27:22 PST