I'm wondering if there is some way to prevent certain certain devices from becoming the output file of the dd command and the target of the fdisk command. I'm currently using the two operations to set up a write a bootloader, kernel, and root filesystem on an SD card, which appears as /dev/sdd. I'm always a little anxious that I'll mix up sdd with sdb, or sda since the letters A and D are close on the keyboard, and I would like to find a way to prevent commands with this format:dd if=/dev/sd[a-zA-Z0-9]* of=/dev/sd[ab]orfdisk /dev/sd[ab]
Protecting Devices from dd and fdisk Commands
linux;command line;hard disk;dd;fdisk
You might try writing a udev rule to give the supplemental HDD(s) sufficiently unique names.Another idea: Whenever you can phrase a security requirement as It's not who's doing it, it's how they're doing it you're talking about type enforcement, and in most Linux distros TE is done at the MAC level. Most of my MAC experience is with SELinuxYou can't lock it down at the DAC level otherwise you wouldn't be able to perform I/O on the device (not necessarily a failing of DAC as a security model, it's just current DAC policy is solely identity based so all programs running under a particular identity get identical rights with no additional administrative expression possible). Locking it down at the MAC level can be made so that regular user space components can't do anything with the block file but your root utilities and certain parts of the platform can. On Fedora this is already kind of the case with block devices showing up with the SELinux type of fixed_disk_device_t and grub having bootloader_exec_t see the following example:[root@localhost ~]# ls -lhZ $(which grub2-install)-rwxr-xr-x. root root system_u:object_r:bootloader_exec_t:s0 /sbin/grub2-install[root@localhost ~]# ls -lhZ /dev/sdabrw-rw----+ root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sda[root@localhost ~]# sesearch --allow | egrep bootloader | grep fixed   allow bootloader_t fixed_disk_device_t : lnk_file { read getattr } ;    allow bootloader_t fixed_disk_device_t : chr_file { ioctl read write getattr lock append open } ;    allow bootloader_t fixed_disk_device_t : blk_file { ioctl read write getattr lock append open } ; [root@localhost ~]# Whereas dd has a regular bin_t label:[root@localhost ~]# ls -lhZ $(which dd)-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /bin/ddbin_t (apparently) can still write to block devices but creating a new file context type for fdisk and dd and writing an selinux rule to disallow the new type from accessing fixed_disk_device_t shouldn't be too difficult. You would just need to make it so regular user roles can't do it but users with the sysadm_t can do it, then remember to just do a newrole -r root:sysadm_r before you try to re-partition the disk or do a dd over the block device (which shouldn't be a huge deal since it's not like you run fdisk every day all day long).Probably more work than you were looking for, but TE is the mechanism that solves the general problem you're running into. Personally, the udev rule is probably you're safest bet. I only mention the TE stuff in case you're interested in solving a larger set of problems similar to this one.