From: Zbigniew Jędrzejewski-Szmek Date: Fri, 11 Dec 2020 11:28:44 +0000 (+0100) Subject: pid1: stop making /dev noexec X-Git-Tag: v248-rc1~529 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4eb105fa4aae30566d23382e8c9430eddf1a3dd4;p=thirdparty%2Fsystemd.git pid1: stop making /dev noexec Quoting Andy Lutomirski: > The upcoming Linux SGX driver has a device node /dev/sgx. User code opens > it, does various setup things, mmaps it, and needs to be able to create > PROT_EXEC mappings. This gets quite awkward if /dev is mounted noexec. We already didn't use noexec in spawn, and this extends this behaviour to other systems. Afaik, the kernel would refuse execve() on a character or block device anyway. Thus noexec on /dev matters only for actual binaries copied to /dev, which requires root privileges in the first place. We don't do noexec on either /tmp or /dev/shm (because that causes immediate problems with stuff like Java and cffi). And if you have those two at your disposal anyway, having noexec on /dev doesn't seem important. So the 'noexec' attribute on /dev doesn't really mean much, since there are multiple other similar directories which don't require root privileges to write to. C.f. https://salsa.debian.org/kernel-team/initramfs-tools/-/commit/33c10ef43b03dc6d9ee09a46c598f6ee34ad0b81. --- diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c index 915b1016b86..1e4bbfb1ab0 100644 --- a/src/core/mount-setup.c +++ b/src/core/mount-setup.c @@ -66,7 +66,7 @@ static const MountPoint mount_table[] = { NULL, MNT_FATAL|MNT_IN_CONTAINER|MNT_FOLLOW_SYMLINK }, { "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, MNT_FATAL|MNT_IN_CONTAINER }, - { "devtmpfs", "/dev", "devtmpfs", "mode=755" TMPFS_LIMITS_DEV, MS_NOSUID|MS_NOEXEC|MS_STRICTATIME, + { "devtmpfs", "/dev", "devtmpfs", "mode=755" TMPFS_LIMITS_DEV, MS_NOSUID|MS_STRICTATIME, NULL, MNT_FATAL|MNT_IN_CONTAINER }, { "securityfs", "/sys/kernel/security", "securityfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, MNT_NONE },