From patchwork Mon Apr 30 20:15:54 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rosen Penev X-Patchwork-Id: 906855 X-Patchwork-Delegate: blogic@openwrt.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=lede-dev-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="NxjQoGmO"; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="mYcCeKDr"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 40ZbQZ6PFmz9s0n for ; Tue, 1 May 2018 06:16:06 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Subject:References: In-Reply-To:Message-Id:Date:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=2/KP2pOfyXx9h4kBdLb/Iw4oPJI3DQk6roDsyQ/z21s=; b=NxjQoGmOpoD4kp 593G8qZ4duSxCaBG7JXJSH8lWOdQWI2KpZLiPNytGcQIzQyiBqm6N1EfPlbfkuXhGa1EncR3ud05D Zb23KKJ/i78hj+MpCYWnOe5scnhe5rMSE37DP7osY4pXzNNd5BY5A/raaGRA/WnU9d4E6EEHS+Ado Ey9Y1Fzdq03ukwoS58oS1cc0T6hlZgKkN/W1agYRbLacYgGPSCOEOJpxcr/LzdbtOR2fBRSSb6kai ePOzzZsdb1fjSHUMmDDltlKGqlEZ3aJYvXv6dh0gMIj4i1qzhoq8/D+TaPNYg9iYhYtReLr5MU6/W eh6sU3rWxSTmjR8+Fidw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fDFDQ-0003RD-Fq; Mon, 30 Apr 2018 20:16:04 +0000 Received: from mail-pf0-x243.google.com ([2607:f8b0:400e:c00::243]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fDFDN-0003Ps-BZ for lede-dev@lists.infradead.org; Mon, 30 Apr 2018 20:16:02 +0000 Received: by mail-pf0-x243.google.com with SMTP id q22so7584726pff.11 for ; Mon, 30 Apr 2018 13:15:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=zXfC3UkjBGuLexZWnYBsfoiMDUcB/wif5z0BI4jmqvw=; b=mYcCeKDrVQc9vQTY85hfQD4AUb/NlH74FgjLWYHc0qXCDThxuWuhYghTyAkzzsn1Ux K3X3pJvd0r/1jEVjgKanEOQbu8nrwxdv2MV9BBzQzpZf5cKrSvhcWLwz3ikIpSHSH4z5 J3RJMiq641QPZrKYJmRPyl5tnqOIC7tgGW6y/t+aqU8qgiOSQTcLaHyOVUItdJ9nKug3 8kv9L8RmAY180rMr9mTpGAfXvhSUc6SBixGCi0J4I7aS+u8e47+vsNdxOk5smHdYjh54 hl83irwTNhWIue22ein8SfTQrAALmguYtFVPaSoFbspD6VB3dhH3Z8AU2RvHMJi+zZIr i+PA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=zXfC3UkjBGuLexZWnYBsfoiMDUcB/wif5z0BI4jmqvw=; b=OF5YtbB4bhW4CGCznML5hEq8YjGJ6apr5VFOL/MSSAs6wiSsnY+aZzi6XTPHKN48D1 nquAcLLcNuOLmKCgdptf4lWzpMd+AsmWJLR/lsBESA0ioO3X02Z8BtOYG45Q55uXZHF3 fv763q7HOhPmMOmKceB6EYmpdC4vcGXCFBH6/eRGxl5jdW9yt6PI6POGNbHFcMoiJ2I4 fjany/EsaxtZluJNzE6m6QhMnBDrWiqXY/6pX5mMuyx+q0WPhWyOG3qfTZfKYvzRfkwt foTgBF3K40SXEJnN4NEHZVLI+48RrxpL0lxkjELer1MhxQSyoZ18xMyZds4E4QSCWufq S+Gg== X-Gm-Message-State: ALQs6tBaME1Xl3ar9+4KtNZ4WEvaLn0gz1/mAU6InDHafUkYpHnIi1Ry 9S2WTT2v0V2VIAlogb8ImKHdDmRT X-Google-Smtp-Source: AB8JxZq9AiU+K5uoTcIeiiXUL9PlthqpleAXYnaNWQyh5JTwdbnW2ZHZtd4nY4QyqFziriwSlMGUNw== X-Received: by 2002:a65:5509:: with SMTP id f9-v6mr11096591pgr.317.1525119349361; Mon, 30 Apr 2018 13:15:49 -0700 (PDT) Received: from DESKTOP-CEH0M93.lan (astound-69-42-5-101.ca.astound.net. [69.42.5.101]) by smtp.gmail.com with ESMTPSA id r8-v6sm246763pgn.2.2018.04.30.13.15.48 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 30 Apr 2018 13:15:48 -0700 (PDT) From: Rosen Penev To: lede-dev@lists.infradead.org Date: Mon, 30 Apr 2018 13:15:54 -0700 Message-Id: <1525119354-23662-1-git-send-email-rosenp@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <20180330221804.29241-3-rosenp@gmail.com> References: <20180330221804.29241-3-rosenp@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180430_131601_423983_66E9BDF9 X-CRM114-Status: UNSURE ( 9.50 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -0.1 (/) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-0.1 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [2607:f8b0:400e:c00:0:0:0:243 listed in] [list.dnswl.org] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (rosenp[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Subject: [LEDE-DEV] [PATCH] sysctl: Protect hard/symlinks by default. X-BeenThere: lede-dev@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Rosen Penev MIME-Version: 1.0 Sender: "Lede-dev" Errors-To: lede-dev-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org There is no usecase for not protecting symlinks that I know of in OpenWrt. Not even on desktop systems where you have multiple users with a shell. Signed-off-by: Rosen Penev v2: Move to 10-default.conf file. --- package/base-files/files/etc/sysctl.d/10-default.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/base-files/files/etc/sysctl.d/10-default.conf b/package/base-files/files/etc/sysctl.d/10-default.conf index 98867b7..bfe26ca 100644 --- a/package/base-files/files/etc/sysctl.d/10-default.conf +++ b/package/base-files/files/etc/sysctl.d/10-default.conf @@ -5,6 +5,10 @@ kernel.panic=3 kernel.core_pattern=/tmp/%e.%t.%p.%s.core fs.suid_dumpable=2 +#enable hard/symlink protection +fs.protected_hardlinks=1 +fs.protected_symlinks=1 + net.ipv4.conf.default.arp_ignore=1 net.ipv4.conf.all.arp_ignore=1 net.ipv4.ip_forward=1