Monitoring and prevention of MBR activity.

[Robb III, George B.]

Hi All-

Have an interesting problem in which monitoring and preventing activity on
the MBR would be very useful.

Has anyone used SELinux for this type of task?

Thanks for any assistance,

George

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/06/2011 09:51 AM, Robb III, George B. wrote:
>  Hi All-
>  
>  Have an interesting problem in which monitoring and preventing
>  activity on the MBR would be very useful.
>  
>  Has anyone used SELinux for this type of task?
>  
>  Thanks for any assistance,
>  
>  George
>  
>  
>  -- selinux mailing list selinux(a)lists.fedoraproject.org 
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
Maybe if I new what MBR stood for?
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk5mKHUACgkQrlYvE4MpobOfIQCgpdo321aB00hzey0O4yGakvK6
> YB8An3R1Jk5Pi+jWx6MP68oqa3zeE0lO
> =0TAk
> -----END PGP SIGNATURE-----

[John Reiser]

> > Have an interesting problem in which monitoring and preventing
> > activity on the MBR would be very useful. 
>  Maybe if I new what MBR stood for? 
Master Boot Record: The first sector (hardware sector 1 [origin is 1])
of the boot drive.  Usually accessed as /dev/sda, for instance:
   dd if=/dev/sda count=1 of=sda.mbr  # read[usual]  Master Boot Record

--

[Robb III, George B.]

Master Boot Record.  Apologies for acronyms...
Literally the first 512 bytes of the boot drive.

George


On Tue, Sep 6, 2011 at 9:04 AM, Daniel J Walsh <dwalsh(a)redhat.com&gt; wrote:

>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  On 09/06/2011 09:51 AM, Robb III, George B. wrote:
>  > Hi All-
>  >
>  > Have an interesting problem in which monitoring and preventing
>  > activity on the MBR would be very useful.
>  >
>  > Has anyone used SELinux for this type of task?
>  >
>  > Thanks for any assistance,
>  >
>  > George
>  >
>  >
>  > -- selinux mailing list selinux(a)lists.fedoraproject.org
>  > https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>  Maybe if I new what MBR stood for?
> >  -----BEGIN PGP SIGNATURE-----
> >  Version: GnuPG v1.4.11 (GNU/Linux)
> >  Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> >
> >  iEYEARECAAYFAk5mKHUACgkQrlYvE4MpobOfIQCgpdo321aB00hzey0O4yGakvK6
> >  YB8An3R1Jk5Pi+jWx6MP68oqa3zeE0lO
> >  =0TAk
> >  -----END PGP SIGNATURE----- 
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>

[Frank Murphy]

On 06/09/11 15:04, Daniel J Walsh wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  On 09/06/2011 09:51 AM, Robb III, George B. wrote:
> > Hi All-
> >
> > Have an interesting problem in which monitoring and preventing
> > activity on the MBR would be very useful. 
>  Maybe if I new what MBR stood for? 
http://en.wikipedia.org/wiki/Master_boot_record


-- 
Regards,

Frank Murphy
UTF_8 Encoded
Friend of fedoraproject.org

[mark]

Robb III, George B. wrote:
>  Have an interesting problem in which monitoring and preventing activity on
>  the MBR would be very useful.
>
>  Has anyone used SELinux for this type of task? 
Why? Most, if not all, BIOSes in the last 15 years allow you to make the
MBR unwriteable, IIRC, so that you have to be at the console, rebooting,
to go into the BIOS to change that. Some also send warning (NMI) to the
console screen if a change is being/about to be made.

That's something that, if I were worried about it, would have locked down
and not have to monitor.

       mark