From: Rui Salvaterra Date: Sun, 9 Jan 2022 23:27:27 +0000 (+0000) Subject: procd: mount /dev with noexec X-Git-Url: http://git.openwrt.org/?p=project%2Fprocd.git;a=commitdiff_plain;h=3b3ac648f48dda5269852994d42c70f61e9db4fe procd: mount /dev with noexec /dev is writable. Allowing execution inside it makes it a possible attack vector. Kees Cook recently sent a kernel patch [1] in order to mount /dev as noexec and nosuid for systems which rely on CONFIG_DEVTMPFS_MOUNT=y to create/populate /dev, which isn't our case (it's procd's responsibility). Add noexec to the /dev mount flags, since we already use nosuid (and keep the coldplug flags symmetric, while at it). This carries the risk of breaking very old, pre-KMS graphics drivers [2], but it shouldn't be a problem for systems built in the last ~15 years. The vast majority of our targets doesn't have a GPU, anyway. :) [1] https://lore.kernel.org/all/YcMfDOyrg647RCmd@debian-BULLSEYE-live-builder-AMD64/ [2] https://lore.kernel.org/all/CAPXgP12e5LpN6XVxaXOHhH=u8XXN==2reTaJDCoCk4tP4QduDQ@mail.gmail.com/ Signed-off-by: Rui Salvaterra --- diff --git a/initd/early.c b/initd/early.c index d69495e..87fee65 100644 --- a/initd/early.c +++ b/initd/early.c @@ -61,7 +61,7 @@ early_mounts(void) mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); mount("cgroup2", "/sys/fs/cgroup", "cgroup2", MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, "nsdelegate"); - mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOSUID, "mode=0755,size=512K"); + mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=0755,size=512K"); ignore(symlink("/tmp/shm", "/dev/shm")); mkdir("/dev/pts", 0755); mount("devpts", "/dev/pts", "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=600"); diff --git a/plug/coldplug.c b/plug/coldplug.c index b185083..b9462e7 100644 --- a/plug/coldplug.c +++ b/plug/coldplug.c @@ -48,7 +48,7 @@ void procd_coldplug(void) if (!is_container()) { umount2("/dev/pts", MNT_DETACH); umount2("/dev/", MNT_DETACH); - mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755,size=512K"); + mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=0755,size=512K"); mkdir("/dev/pts", 0755); mount("devpts", "/dev/pts", "devpts", MS_NOEXEC | MS_NOSUID, 0); }