I am learning about linux security and struggling to understand why a USB stick with a character device on it is potentially dangerous.If I have a USB stick with a bash executable that has setuid root on it, the danger is obvious: Anybody with such a USB stick can gain root privileges on my computer if I have an entry like /dev/sdb1 /media/usbstick auto defaults 0 0in my /etc/fstab because defaults includes suid.But what about character devices? How can I use a character device to gain root privileges or break stuff if a USB stick with a character device on it gets mounted with dev or defaults?
Why is nodev in /etc/fstab so important? How can character devices be used for hacking?
mount;security;devices;fstab
Because access to the underlying device is controlled only by file permissions by default, so if your USB stick contains a POSIX filesystem with a world-writable device node corresponding to a real device in the system, you can use that device node to access the corresponding device as a plain user. Imagine a device corresponding to one of the audio devices, your webcam, /dev/sda (which is a block device rather than a character device, but the argument is the same), or /dev/mem...Here's an example to make things clearer. Say you want to access /dev/mem (then you can pretty much do anything you want, including become root). On your target system, ls -l /dev/mem showscrw-r-----  1 root kmem      1,   1 Sep  8 11:25 memThis means /dev/mem is a character device (the c at the beginning of the line), with major number 1 and minor number 1 (the 1, 1 in the middle of the line). The device is only accessible to root (read/write) and members of the kmem group (read-only).Now imagine on this system you can't become root but for some reason you can mount USB sticks as a user without nodev. On another system, where you are root, you can create a corresponding special file on your USB key:mknod -m 666 usermem c 1 1This will create a special file called usermem, readable and writable by everyone.Mount the key on your target system and hey presto, you can use the usermem device in the same way as /dev/mem, but with no access restriction...