Linux boot parameters and hacking

Question

Bear with me since I'm a linux noob... I had an assignment for a security class in which I was supposed to gain access to a file in on an administrator's desktop.

I modified the boot settings by changing "ro splash" to "rw init=/bin/bash", restarted, got a bash shell and changed the root password.

A couple questions:

• So ro mounts the root device as read-only, rw mounts it as read-write. What is the "root device"?
• So init specifies the first program to run after boot, correct?
• Why do I get a bash shell that has root access? No authentication required?

Answer 1

1. The "root" device is defined in the bootloader and is the "bootstrap" location/drive/partition.
2. Yes.
3. This is a feature that allows a machine operator to get in and recover a machine.

Remember, a machine is only secure if it is not only secure on the network, but is also physically secure. Many people forget this and only consider "across-the-wire" attacks. A machine is NOT secure if just anyone can get to it. If I can get to your machine, chances are I can boot it from a CD-ROM/USB/floppy and take it over -- no matter what "password" your root user ma have. ALWAYS secure the physical machine.

Matt

Answer 2

1. root is the device that the kernel sees as the location of /. The bootloader can use a different root device, the bootloader uses it to read the kernel and the initial ramdisk into memory.

2. init is the first (and only) user space program started by the kernel, and this has the task to manage user space (i.e. everything else than kernel space). Normally you would use either SystemV init or SystemD systemd, because they will handle the startup of dæmons, the mounting of filesystem etc. If you use /bin/bash (anything else works as well), this program gets executed after the kernel has initialized itself, and of course has full access to every device on the computer (i.e. root access). This is not a feature for system administrators, this possibility derives from the open design of the boot process.

3. Yes, because authentication is not handled by the kernel, this has to be done by a user space process, normally by one started by init. To do this, init needs root access...

As the other poster pointed out, if you have hardware access, authentication handled by the operating system (and not based on strong encryption) is futile. For example, you can boot a computer with a live system (on CD), mount the file systems and just chroot yourself in. With full root access... Encryption is the way to go!