Protecting Disk Partitions and Logical Volumes

Ensure that the device special files for disk partitions and logical volumes are readable only by root and perhaps by an account used for disk backups. See Section .

Because ownership and permissions are stored in the inode, anyone with write permission to a mounted partition can set the user ID for any file in that partition. The file is subject to change regardless of the owner, bypassing the chmod() system call and other security checks.

If the device special file is writable, a user can open that file and access the raw disk. The user can then directly edit the file system, read files, or change file permissions and owners.

Make sure the file permissions forbid access to the device special file and allow only root to read.

If a program, such as a database application, requires direct access to the partition, reserve that partition exclusively for the program. Do not mount a partition as a file system if users can access the partition directly. If you do mount a partition as a file system, users could edit the underlying file system.

Inform program users that the file's security is enforced by its permission settings rather than by the HP-UX file system.