This is what a root debug backdoor in a Linux kernel looks like

Re: Whoops

Be thankful the version number starts with a 3: I know of firms that ship supported kernels with version numbers beginning with 2!

How do I delete the /proc/sunxi_debug/sunxi_debug file?

You can't.

It is not a real file, but part of the the device driver's internal memory that is presented as if it were a file.

That is how the UNIX model works, everything is a "file". You can access the keyboard and terminal as stdin and stdout, etc (same as Windows there). Hard disks appear as /dev/sda and the partitions on them as /dev/sda1 and so on, serial ports as /dev/ttyS0, etc, etc.

Re: Mr

I think you'll need to exploit the vulnerability to remove it. Write the magic string to the device to become root, then you can remove the device from the FS. Then abandon your root privilege.

Something like that.

Re: Mr

The only way to remove it is to patch and rebuild the kernel without the code that creates it. /proc is virtual and not a real file system you can change.

And the file is 0 length since you activate it by writing a string to it (with echo for example). Since it is virtual, the file size will not change from doing this.

Re: Vulnerable?

@johnaaronrose

I take it you didn't read the article then ?

Re: Vulnerable?

From the article: 'As tkaiser writes, echo "rootmydevice" > /proc/sunxi_debug/sunxi_debug" "from any process with any UID will get root'

Hahaha. I've personally seen stuff like this get missed by "upstream review and merge"

IMHO that process has become yet another Agile/DevOp tickbox that doesn't mean anything any more.

Re: Writing to /proc as user?

"Why are user processes, presumably in some sort of sandbox for protection against dodgy stuff, allowed to *write* to /proc? "

Quite - although (for example) in my copies of OpenSUSE only ~ 3 entries are writable - and that only by root. True also for the pi(s) with one exception.

Re: Writing to /proc as user?

I would assume that specific file was made writable by ordinary users specifically because it's a debug thing intended to root your device (and Android by default does not allow you root access if I recall correctly).

Re: Writing to /proc as user?

You know, it used to be that the correct user of permissions, separate UID and GIDs for applications, and the standard UNIX permission model was deemed sufficient to protect from most application programs, without a sandbox.

The whole idea of sandboxes came about on other OSs, which needed the OS to be protected from applications.

I appreciate that modern sandbox implementations allow resources to be fenced as well as access, and also that chroot used to be commonly used to give more protection, but still the assumption that a sandbox is required on a Linux system suggests that there is something wrong in the implementation or configuration of the systems (and that is what the article suggests).

Re: At least they have bothered putting kernel code in Github

Unlike Mediatek. Still violating GPL after all these years.

Or possibly AMLogic, or Rockchip.. I guess it must be a Chinese Firewall thing...

Also is allows "rootmydeviceyoubunchofuselessfuckers" to match..