diff mbox

[OpenWrt-Devel,procd] Add MS_NODEV MS_NOEXEC MS_NOSUID mount options where needed

Message ID 1442690445-29345-1-git-send-email-champetier.etienne@gmail.com
State Accepted
Headers show

Commit Message

Etienne Champetier Sept. 19, 2015, 7:20 p.m. UTC 
These options aren't mandatory, but can prevent some future
bugs from being exploited. Good reading:
http://lwn.net/Articles/647757/

Value chosen by looking at fedora 22 / ubuntu 14.04

Not tested yet (away from my tests routers)

Not touching jail/jail.c as this conflict with
my pending patch serie

Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
---
 initd/early.c   | 12 ++++++------
 plug/coldplug.c |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)
diff mbox

Patch

diff --git a/initd/early.c b/initd/early.c
index 89c8104..f410256 100644
--- a/initd/early.c
+++ b/initd/early.c
@@ -62,18 +62,18 @@  early_mounts(void)
 {
 	unsigned int oldumask = umask(0);
 
-	mount("proc", "/proc", "proc", MS_NOATIME, 0);
-	mount("sysfs", "/sys", "sysfs", MS_NOATIME, 0);
-	mount("none", "/sys/fs/cgroup", "cgroup", 0, 0);
-	mount("tmpfs", "/dev", "tmpfs", MS_NOATIME, "mode=0755,size=512K");
+	mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+	mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+	mount("cgroup", "/sys/fs/cgroup", "cgroup",  MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+	mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOSUID, "mode=0755,size=512K");
 	symlink("/tmp/shm", "/dev/shm");
 	mkdir("/dev/pts", 0755);
-	mount("devpts", "/dev/pts", "devpts", MS_NOATIME, "mode=600");
+	mount("devpts", "/dev/pts", "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=600");
 	early_dev();
 
 	early_console("/dev/console");
 	if (mount_zram_on_tmp()) {
-		mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, NULL);
+		mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, 0);
 		mkdir("/tmp/shm", 01777);
 	} else {
 		mkdir("/tmp/shm", 01777);
diff --git a/plug/coldplug.c b/plug/coldplug.c
index bfd3513..123e17d 100644
--- a/plug/coldplug.c
+++ b/plug/coldplug.c
@@ -44,11 +44,11 @@  void procd_coldplug(void)
 
 	umount2("/dev/pts", MNT_DETACH);
 	umount2("/dev/", MNT_DETACH);
-	mount("tmpfs", "/dev", "tmpfs", 0, "mode=0755,size=512K");
+	mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755,size=512K");
 	symlink("/tmp/shm", "/dev/shm");
 	mkdir("/dev/pts", 0755);
 	umask(oldumask);
-	mount("devpts", "/dev/pts", "devpts", 0, 0);
+	mount("devpts", "/dev/pts", "devpts", MS_NOEXEC | MS_NOSUID, 0);
 	udevtrigger.cb = udevtrigger_complete;
 	udevtrigger.pid = fork();
 	if (!udevtrigger.pid) {