[clug] Effects of hacking on md

Darren Freeman daz111 at rsphysse.anu.edu.au
Sun Mar 6 10:08:38 GMT 2005

On Fri, 2005-03-04 at 13:32, Michael James wrote:
> I'm beginning to suspect attempts at hacking.

If you haven't seen anything else out of place, look a little closer to

> What would happen to a software mirror
>  if somebody tried to bust out of a chroot jail
>  by accessing the disks directly?

They would need very elevated privileges, surely they could find other

> They'd dirty the mirror and trigger a rebuild
>  wouldn't they?

I've never seen that. MD isn't clever enough to notice access via the
individual devices. Try it for yourself on another box. I *hope* you
can't access the discs separately at all but if you can, I bet it
doesn't even notice.

> And how does a mirror rebuild anyway?
> I mean, I have 2 pieces of data, they're different.
> Which is right?

The primary drive is copied to the others. It's that simple. Drives are
supposed to report when they are failing because they have inbuilt
checksums. Therefore if the primary drive isn't failing, it's correct.

> It's all too much like a duck, only in this case,
>  one of its legs are both a bit different.

sorry I don't follow, we're talking about penguins right?

> michaelj

Have fun,

More information about the linux mailing list