diff options
| author | Etienne CHAMPETIER <champetier.etienne@gmail.com> | 2015-09-19 21:20:45 +0200 |
|---|---|---|
| committer | John Crispin <blogic@openwrt.org> | 2015-10-03 10:04:52 +0200 |
| commit | fafbf7338ec8304f2a0ec0ba76048fba2c01c07e (patch) | |
| tree | d14acda37e8b24a044e0994a57192cc936da3380 | |
| parent | c2f1f1908b43f945efc99cb43b49e512ee5d02aa (diff) | |
| download | unitd-fafbf7338ec8304f2a0ec0ba76048fba2c01c07e.tar unitd-fafbf7338ec8304f2a0ec0ba76048fba2c01c07e.zip | |
Add MS_NODEV MS_NOEXEC MS_NOSUID mount options where needed
These options aren't mandatory, but can prevent some future
bugs from being exploited. Good reading:
http://lwn.net/Articles/647757/
Value chosen by looking at fedora 22 / ubuntu 14.04
Not tested yet (away from my tests routers)
Not touching jail/jail.c as this conflict with
my pending patch serie
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
| -rw-r--r-- | initd/early.c | 12 | ||||
| -rw-r--r-- | plug/coldplug.c | 4 |
2 files changed, 8 insertions, 8 deletions
diff --git a/initd/early.c b/initd/early.c index 89c8104..f410256 100644 --- a/initd/early.c +++ b/initd/early.c @@ -62,18 +62,18 @@ early_mounts(void) { unsigned int oldumask = umask(0); - mount("proc", "/proc", "proc", MS_NOATIME, 0); - mount("sysfs", "/sys", "sysfs", MS_NOATIME, 0); - mount("none", "/sys/fs/cgroup", "cgroup", 0, 0); - mount("tmpfs", "/dev", "tmpfs", MS_NOATIME, "mode=0755,size=512K"); + mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); + mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); + mount("cgroup", "/sys/fs/cgroup", "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID, 0); + mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOSUID, "mode=0755,size=512K"); symlink("/tmp/shm", "/dev/shm"); mkdir("/dev/pts", 0755); - mount("devpts", "/dev/pts", "devpts", MS_NOATIME, "mode=600"); + mount("devpts", "/dev/pts", "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=600"); early_dev(); early_console("/dev/console"); if (mount_zram_on_tmp()) { - mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, NULL); + mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, 0); mkdir("/tmp/shm", 01777); } else { mkdir("/tmp/shm", 01777); diff --git a/plug/coldplug.c b/plug/coldplug.c index bfd3513..123e17d 100644 --- a/plug/coldplug.c +++ b/plug/coldplug.c @@ -44,11 +44,11 @@ void procd_coldplug(void) umount2("/dev/pts", MNT_DETACH); umount2("/dev/", MNT_DETACH); - mount("tmpfs", "/dev", "tmpfs", 0, "mode=0755,size=512K"); + mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755,size=512K"); symlink("/tmp/shm", "/dev/shm"); mkdir("/dev/pts", 0755); umask(oldumask); - mount("devpts", "/dev/pts", "devpts", 0, 0); + mount("devpts", "/dev/pts", "devpts", MS_NOEXEC | MS_NOSUID, 0); udevtrigger.cb = udevtrigger_complete; udevtrigger.pid = fork(); if (!udevtrigger.pid) { |