[clug] Effects of hacking on md

[Darren Freeman]

On Fri, 2005-03-04 at 13:32, Michael James wrote:
> I'm beginning to suspect attempts at hacking.

If you haven't seen anything else out of place, look a little closer to
home!

> What would happen to a software mirror
>  if somebody tried to bust out of a chroot jail
>  by accessing the disks directly?

They would need very elevated privileges, surely they could find other
means.

> They'd dirty the mirror and trigger a rebuild
>  wouldn't they?

I've never seen that. MD isn't clever enough to notice access via the
individual devices. Try it for yourself on another box. I *hope* you
can't access the discs separately at all but if you can, I bet it
doesn't even notice.

> And how does a mirror rebuild anyway?
> I mean, I have 2 pieces of data, they're different.
> Which is right?

The primary drive is copied to the others. It's that simple. Drives are
supposed to report when they are failing because they have inbuilt
checksums. Therefore if the primary drive isn't failing, it's correct.

> It's all too much like a duck, only in this case,
>  one of its legs are both a bit different.

sorry I don't follow, we're talking about penguins right?

> michaelj

Have fun,
Darren