Re: [cobalt-users] Trinoo DDoS server in init

[flash22@xxxxxxx]

On Thu, 15 Feb 2001, Craig Napier wrote:

> >So which is the real init?
As a stray note here, here is where the kernel tries to find init when
booting (provided you didn't tell it specificlly to look elsewhere via
boot time command)

        execve("/sbin/init",argv_init,envp_init);
        execve("/etc/init",argv_init,envp_init);
        execve("/bin/init",argv_init,envp_init);
        execve("/bin/sh",argv_init,envp_init);
        panic("No init found.  Try passing init= option to kernel.");

Note that it tries to run them *all* , the real init is the one that
gets the first process id, the rest will quit when they discover they
aren't PID 1 , but this is only if they are really init's ;)

(Eg this is a potential hole, since you can make the kernel execute a
bogus init if you can manage to place it in a macic place)

Obviously, /sbin,/bin,/etc must be writable *ONLY* by root to prevent this

gsh