lkml.org 
[lkml]   [2012]   [Nov]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH v2] devtmpfs: mount with noexec and nosuid
    From
    On Tue, Nov 20, 2012 at 1:13 PM, Alan Cox <alan@lxorguk.ukuu.org.uk> wrote:
    > On Tue, 20 Nov 2012 12:42:38 -0800
    > Kees Cook <keescook@chromium.org> wrote:
    >
    >> Since devtmpfs is writable, make the default noexec,nosuid as well. This
    >> protects from the case of a privileged process having an arbitrary file
    >> write flaw and an argumentless arbitrary execution (i.e. it would lack
    >> the ability to run "mount -o remount,exec,suid /dev").
    >
    > Ok this looks crap on two levels.
    >
    > 1. Why not just have your userspace mount -o remount the file system this
    > way already in early boot. (and if you trojanned boot that early then any
    > supposed security gain is already lost)

    That's certainly possible, but I am hoping to avoid adding any extra
    boot time. The kernel is responsible for this mount, so its flags
    should be configurable, resulting in no time penalty anywhere.

    > 2. If you want to do this right then you need to work out what you are
    > trying to prevent. Your devtmpfs can force file permissions on the
    > underlying device nodes by having its own operation handling for chmod.
    >
    > At that point you can force permissions on anything that you want to
    > avoid floating around that filesystem with other rights, while not
    > touching it on device or directory nodes where the meaning is different.
    >
    > In its current form however it appears to be a kernel implementation of
    > "mount is too hard".

    This change also stops mmap() with PROT_EXEC which a chmod handler
    wouldn't be able to do. The noexec and nosuid mount options were
    designed for this sort of thing, so I think that's where it should be
    handled.

    -Kees

    --
    Kees Cook
    Chrome OS Security


    \
     
     \ /
      Last update: 2012-11-20 23:21    [W:2.961 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site