[CentOS] Writing to a symlink on a read-only file system that land on a read-write file system

Mon Apr 22 15:50:26 UTC 2013
James Pearson <james-p at moving-picture.com>

m.roth at 5-cent.us wrote:
> James Pearson wrote:
> 
>>We've come across a problem with 6.4 kernels that we didn't have with
>>6.2 kernels - which involves writing to a symlink that is on a read-only
>>file system - but the symlink lands on a read-write file system
>>
>>The following shows the issue:
>>
>>  mkdir -p /mnt/tmp
>>  mount -t tmpfs -o size=1% none /mnt/tmp
>>  rm -f /tmp/file
>>  ln -s /tmp/file /mnt/tmp/file
>>  mount -o remount,ro /mnt/tmp
>>  echo "some text" > /mnt/tmp/file
> 
> <snip>
> That's weird, all right... but I would *never* have tried that, because I
> assume that ro mean READ ONLY. IMO, if you could write *anything* to a
> read-only filesystem, that was a serious bug, both in design and in
> security (gee, what a *great* way to get malware where it shouldn't be!).

But we're not writing to a read-only file system ... the symlink lands 
on a read-write file system - where the file is created/updated

James Pearson