summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEtienne CHAMPETIER <champetier.etienne@gmail.com>2015-09-19 21:20:45 +0200
committerJohn Crispin <blogic@openwrt.org>2015-10-03 10:04:52 +0200
commitfafbf7338ec8304f2a0ec0ba76048fba2c01c07e (patch)
treed14acda37e8b24a044e0994a57192cc936da3380
parentc2f1f1908b43f945efc99cb43b49e512ee5d02aa (diff)
downloadunitd-fafbf7338ec8304f2a0ec0ba76048fba2c01c07e.tar
unitd-fafbf7338ec8304f2a0ec0ba76048fba2c01c07e.zip
Add MS_NODEV MS_NOEXEC MS_NOSUID mount options where needed
These options aren't mandatory, but can prevent some future bugs from being exploited. Good reading: http://lwn.net/Articles/647757/ Value chosen by looking at fedora 22 / ubuntu 14.04 Not tested yet (away from my tests routers) Not touching jail/jail.c as this conflict with my pending patch serie Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
-rw-r--r--initd/early.c12
-rw-r--r--plug/coldplug.c4
2 files changed, 8 insertions, 8 deletions
diff --git a/initd/early.c b/initd/early.c
index 89c8104..f410256 100644
--- a/initd/early.c
+++ b/initd/early.c
@@ -62,18 +62,18 @@ early_mounts(void)
{
unsigned int oldumask = umask(0);
- mount("proc", "/proc", "proc", MS_NOATIME, 0);
- mount("sysfs", "/sys", "sysfs", MS_NOATIME, 0);
- mount("none", "/sys/fs/cgroup", "cgroup", 0, 0);
- mount("tmpfs", "/dev", "tmpfs", MS_NOATIME, "mode=0755,size=512K");
+ mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("cgroup", "/sys/fs/cgroup", "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOSUID, "mode=0755,size=512K");
symlink("/tmp/shm", "/dev/shm");
mkdir("/dev/pts", 0755);
- mount("devpts", "/dev/pts", "devpts", MS_NOATIME, "mode=600");
+ mount("devpts", "/dev/pts", "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=600");
early_dev();
early_console("/dev/console");
if (mount_zram_on_tmp()) {
- mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, NULL);
+ mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, 0);
mkdir("/tmp/shm", 01777);
} else {
mkdir("/tmp/shm", 01777);
diff --git a/plug/coldplug.c b/plug/coldplug.c
index bfd3513..123e17d 100644
--- a/plug/coldplug.c
+++ b/plug/coldplug.c
@@ -44,11 +44,11 @@ void procd_coldplug(void)
umount2("/dev/pts", MNT_DETACH);
umount2("/dev/", MNT_DETACH);
- mount("tmpfs", "/dev", "tmpfs", 0, "mode=0755,size=512K");
+ mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755,size=512K");
symlink("/tmp/shm", "/dev/shm");
mkdir("/dev/pts", 0755);
umask(oldumask);
- mount("devpts", "/dev/pts", "devpts", 0, 0);
+ mount("devpts", "/dev/pts", "devpts", MS_NOEXEC | MS_NOSUID, 0);
udevtrigger.cb = udevtrigger_complete;
udevtrigger.pid = fork();
if (!udevtrigger.pid) {