On Wed, Aug 27, 2003 at 12:54:12PM -0500, Chris Barnes wrote:
> Jay Lessert <jayl AT accelerant DOT net> wrote:
> > On Wed, Aug 27, 2003 at 01:33:01PM -0400, Jeremy L. Mordkoff wrote:
> >> My policy is to never restore files in place.
> >
> > I agree that is a good practice (doesn't prevent Chris' student's
> > proposed exploit, though).
> 
> Actually, I think it might.

Chris,

I don't remember your exact example, but not in all cases (unless I'm
missing something obvious...):

#!/bin/sh
cd /home/joebob/src
ln -s /bin
sleep 86400
rm bin
mkdir bin
cp -p /home/joebob/bin/my_ls bin/ls
sleep 86400
rm -r *

mail -s "restore request" helpdesk@go_aggies.edu <<'EOMESSAGE'
Dear helpful admin,

I accidentally did an 'rm -r *' on my src directory this morning:

    /home/joebob/src

Could you please restore it?  Thanks!

-Joebob-
EOMESSAGE

That does it, right?  Doesn't matter what file system or what host the
the amrecover is run on, I've got /bin/ls on that box when it's done
(subject to my qualifiers re: OS and program earlier in the thread).

-- 
Jay Lessert                               jay_lessert AT accelerant DOT net
Accelerant Networks Inc.                       (voice)1.503.439.3461
Beaverton OR, USA                                (fax)1.503.466.9472