From fafbf7338ec8304f2a0ec0ba76048fba2c01c07e Mon Sep 17 00:00:00 2001 From: Etienne CHAMPETIER Date: Sat, 19 Sep 2015 19:20:45 +0000 Subject: Add MS_NODEV MS_NOEXEC MS_NOSUID mount options where needed These options aren't mandatory, but can prevent some future bugs from being exploited. Good reading: http://lwn.net/Articles/647757/ Value chosen by looking at fedora 22 / ubuntu 14.04 Not tested yet (away from my tests routers) Not touching jail/jail.c as this conflict with my pending patch serie Signed-off-by: Etienne CHAMPETIER --- plug/coldplug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'plug') diff --git a/plug/coldplug.c b/plug/coldplug.c index bfd3513..123e17d 100644 --- a/plug/coldplug.c +++ b/plug/coldplug.c @@ -44,11 +44,11 @@ void procd_coldplug(void) umount2("/dev/pts", MNT_DETACH); umount2("/dev/", MNT_DETACH); - mount("tmpfs", "/dev", "tmpfs", 0, "mode=0755,size=512K"); + mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755,size=512K"); symlink("/tmp/shm", "/dev/shm"); mkdir("/dev/pts", 0755); umask(oldumask); - mount("devpts", "/dev/pts", "devpts", 0, 0); + mount("devpts", "/dev/pts", "devpts", MS_NOEXEC | MS_NOSUID, 0); udevtrigger.cb = udevtrigger_complete; udevtrigger.pid = fork(); if (!udevtrigger.pid) { -- cgit v1.2.3