From 4eb105fa4aae30566d23382e8c9430eddf1a3dd4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 11 Dec 2020 12:28:44 +0100 Subject: [PATCH] pid1: stop making /dev noexec Quoting Andy Lutomirski: > The upcoming Linux SGX driver has a device node /dev/sgx. User code opens > it, does various setup things, mmaps it, and needs to be able to create > PROT_EXEC mappings. This gets quite awkward if /dev is mounted noexec. We already didn't use noexec in spawn, and this extends this behaviour to other systems. Afaik, the kernel would refuse execve() on a character or block device anyway. Thus noexec on /dev matters only for actual binaries copied to /dev, which requires root privileges in the first place. We don't do noexec on either /tmp or /dev/shm (because that causes immediate problems with stuff like Java and cffi). And if you have those two at your disposal anyway, having noexec on /dev doesn't seem important. So the 'noexec' attribute on /dev doesn't really mean much, since there are multiple other similar directories which don't require root privileges to write to. C.f. https://salsa.debian.org/kernel-team/initramfs-tools/-/commit/33c10ef43b03dc6d9ee09a46c598f6ee34ad0b81. --- src/core/mount-setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c index 915b1016b8..1e4bbfb1ab 100644 --- a/src/core/mount-setup.c +++ b/src/core/mount-setup.c @@ -66,7 +66,7 @@ static const MountPoint mount_table[] = { NULL, MNT_FATAL|MNT_IN_CONTAINER|MNT_FOLLOW_SYMLINK }, { "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, MNT_FATAL|MNT_IN_CONTAINER }, - { "devtmpfs", "/dev", "devtmpfs", "mode=755" TMPFS_LIMITS_DEV, MS_NOSUID|MS_NOEXEC|MS_STRICTATIME, + { "devtmpfs", "/dev", "devtmpfs", "mode=755" TMPFS_LIMITS_DEV, MS_NOSUID|MS_STRICTATIME, NULL, MNT_FATAL|MNT_IN_CONTAINER }, { "securityfs", "/sys/kernel/security", "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, MNT_NONE },