LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 12-15-2010, 04:38 PM   #1
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,303

Rep: Reputation: 57
Does linux execute master boot record code


It seems that in order to read the partition table an o/s must execute some executable code at the beginning of a disk, in the area known as the master boot record.

This bizarre design came into being so there is flexibility in the design of partitioning tables. It also means viruses can reside in the mbr, and that is where the first ever virus resided.

Nowadays mbr infections are rare, but I wonder. Does linux still execute the instructions in the mbr machine code to get a partition table?
 
Old 12-15-2010, 05:05 PM   #2
mlangdn
Senior Member
 
Registered: Mar 2005
Location: Kentucky
Distribution: Slackware64-current
Posts: 1,845

Rep: Reputation: 452Reputation: 452Reputation: 452Reputation: 452Reputation: 452
This link will explain it better than I can:

http://en.wikipedia.org/wiki/Master_boot_record
 
1 members found this post helpful.
Old 12-15-2010, 06:01 PM   #3
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,303

Original Poster
Rep: Reputation: 57
Quote:
Originally Posted by mlangdn View Post
This link will explain it better than I can:

http://en.wikipedia.org/wiki/Master_boot_record
Before I read all of that, can we go straight to the answer? Is it "no" because that machine code is only executed when booting off that disk drive and not executed for other disk drives?
 
Old 12-15-2010, 06:06 PM   #4
Cultist
Member
 
Registered: Feb 2010
Location: Georgia
Distribution: Slackware64 14.2
Posts: 779

Rep: Reputation: 107Reputation: 107
I might be mistaken, but doesn't the mbr run before the operating system?
 
Old 12-15-2010, 06:31 PM   #5
eSelix
Senior Member
 
Registered: Oct 2009
Location: Wroclaw, Poland
Distribution: Arch, Kubuntu
Posts: 1,281

Rep: Reputation: 320Reputation: 320Reputation: 320Reputation: 320
The BIOS has no other way to pass control to operating system. It is done through MBR of disk selected as boot device in BIOS (I think in EFI this is different). For example there could be installed GRUB. And yes, the virus can reside there. It can be installed under running Linux (of course, it must bypass its security) or other system, so is not very secure to use the same drives with Linux and other OS, like Windows.

Last edited by eSelix; 12-16-2010 at 03:56 AM.
 
Old 12-19-2010, 12:17 PM   #6
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,303

Original Poster
Rep: Reputation: 57
So a windows virus can execute in linux?
 
Old 12-19-2010, 12:21 PM   #7
Ulysses_
Senior Member
 
Registered: Jul 2009
Posts: 1,303

Original Poster
Rep: Reputation: 57
And the partition table of a data disk (ie not the one you boot) can be accessed without the mbr code being executed?
 
Old 12-20-2010, 04:41 AM   #8
eSelix
Senior Member
 
Registered: Oct 2009
Location: Wroclaw, Poland
Distribution: Arch, Kubuntu
Posts: 1,281

Rep: Reputation: 320Reputation: 320Reputation: 320Reputation: 320
Quote:
Originally Posted by Ulysses_ View Post
So a windows virus can execute in linux?
There are 3 possibilites:
1. You have installed 'wine' or similar software (not emulator) - if you explicty run Windows virus, it will run and can do anything that Linux user can do under that user account. The virus must known it is run under wine, to make changes in Linux filesystem. If not it will only can make changes in ~/.wine directory

2. I hear that virus can be compiled in a way to execute in both operating systems, but I don't known if it is true.

3. If virus in some way will change MBR it will run before any operating system, and can do anything.

Quote:
And the partition table of a data disk (ie not the one you boot) can be accessed without the mbr code being executed?
Yes, code from MBR is only needed to start your operating system. To read partition layout there is no need to execute any code from MBR. Tools from operating system known how to read partition table.
 
Old 12-20-2010, 05:08 AM   #9
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,140

Rep: Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123
No.
 
Old 12-20-2010, 06:19 AM   #10
GlennsPref
Senior Member
 
Registered: Apr 2004
Location: Brisbane, Australia
Distribution: Devuan
Posts: 3,657
Blog Entries: 33

Rep: Reputation: 283Reputation: 283Reputation: 283
Syd00, surely you can come up with a "more than" 1 syllable answer.

I'm also intrigued by this issue.

But, have not had any trouble dual booting M$win on the same HD's as GNU/Linux.
(except lately, no boot sometimes).

Could I be wrong?

Please expand your answer.

Regards Glenn

<edit>I have good backups, restoring is an-other matter entirely. </edit>

Last edited by GlennsPref; 12-20-2010 at 06:20 AM.
 
Old 12-20-2010, 06:29 AM   #11
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,140

Rep: Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123
As per #3, seems the OP isn't interested in putting any effort into finding out.
AFAIAC the following questions I also answered.
 
Old 12-20-2010, 07:07 AM   #12
GlennsPref
Senior Member
 
Registered: Apr 2004
Location: Brisbane, Australia
Distribution: Devuan
Posts: 3,657
Blog Entries: 33

Rep: Reputation: 283Reputation: 283Reputation: 283
Nothing personal buddy (Syg00), just though you may have more to offer.

Glenn
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
master boot record goldeneagle1234 Linux - Newbie 2 11-09-2008 08:58 AM
master boot record???? harsh.911 Linux - Newbie 10 06-15-2008 08:25 AM
Master Boot Record linuxuser05 Linux - General 3 01-11-2004 06:57 PM
master boot record alaios Linux - General 1 04-22-2003 08:41 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:20 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration