diff options
| author | Kees Cook <keescook@chromium.org> | 2021-12-22 13:50:20 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-12-30 13:54:42 +0100 |
| commit | 28f0c335dd4a1a4b44b3e6c6402825a93132e1a4 (patch) | |
| tree | bedbed9cd81bfd3985845a7d57ae0ea6bc22ea2f /drivers/base/Kconfig | |
| parent | driver core: Simplify async probe test code by using ktime_ms_delta() (diff) | |
| download | linux-28f0c335dd4a1a4b44b3e6c6402825a93132e1a4.tar.xz linux-28f0c335dd4a1a4b44b3e6c6402825a93132e1a4.zip | |
devtmpfs: mount with noexec and nosuid
devtmpfs is writable. Add the noexec and nosuid as default mount flags
to prevent code execution from /dev. The systems who don't use systemd
and who rely on CONFIG_DEVTMPFS_MOUNT=y are the ones to be protected by
this patch. Other systems are fine with the udev solution.
No sane program should be relying on executing from /dev. So this patch
reduces the attack surface. It doesn't prevent any specific attack, but
it reduces the possibility that someone can use /dev as a place to put
executable code. Chrome OS has been carrying this patch for several
years. It seems trivial and simple solution to improve the protection of
/dev when CONFIG_DEVTMPFS_MOUNT=y.
Original patch:
https://lore.kernel.org/lkml/20121120215059.GA1859@www.outflux.net/
Cc: ellyjones@chromium.org
Cc: Kay Sievers <kay@vrfy.org>
Cc: Roland Eggner <edvx1@systemanalysen.net>
Co-developed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Link: https://lore.kernel.org/r/YcMfDOyrg647RCmd@debian-BULLSEYE-live-builder-AMD64
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/base/Kconfig')
| -rw-r--r-- | drivers/base/Kconfig | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig index ffcbe2bc460e..6f04b831a5c0 100644 --- a/drivers/base/Kconfig +++ b/drivers/base/Kconfig @@ -62,6 +62,17 @@ config DEVTMPFS_MOUNT rescue mode with init=/bin/sh, even when the /dev directory on the rootfs is completely empty. +config DEVTMPFS_SAFE + bool "Use nosuid,noexec mount options on devtmpfs" + depends on DEVTMPFS + help + This instructs the kernel to include the MS_NOEXEC and MS_NOSUID mount + flags when mounting devtmpfs. + + Notice: If enabled, things like /dev/mem cannot be mmapped + with the PROT_EXEC flag. This can break, for example, non-KMS + video drivers. + config STANDALONE bool "Select only drivers that don't need compile-time external firmware" default y |