diff options
| author | Hauke Mehrtens | 2024-11-14 20:46:36 +0000 |
|---|---|---|
| committer | Petr Štetiar | 2024-11-28 18:47:23 +0000 |
| commit | 7d4be068da502cd68f252cad73d18faf8e59e2a5 (patch) | |
| tree | f0de13d9b652b4207beb6daea516efcb973ccb2c | |
| parent | 71d60c69836de7543e86fddb60e8c3eba05ef50e (diff) | |
| download | openwrt-7d4be068da502cd68f252cad73d18faf8e59e2a5.tar.gz | |
base-files: Mount debugfs and pstore with nosuid,nodev,noexec
These permissions are not needed. Systemd also mounts these file systems
without these permissions on other Linux distributions.
Dropping these permissions should make the system more secure.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/16960
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit b88d51898d126d2f918cb476d4158e9fcd62492c)
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
| -rwxr-xr-x | package/base-files/files/etc/init.d/boot | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/package/base-files/files/etc/init.d/boot b/package/base-files/files/etc/init.d/boot index 332a5c96f3..a26d4886b2 100755 --- a/package/base-files/files/etc/init.d/boot +++ b/package/base-files/files/etc/init.d/boot @@ -35,9 +35,9 @@ boot() { mkdir -p /tmp/resolv.conf.d touch /tmp/resolv.conf.d/resolv.conf.auto ln -sf /tmp/resolv.conf.d/resolv.conf.auto /tmp/resolv.conf - grep -q debugfs /proc/filesystems && /bin/mount -o noatime -t debugfs debugfs /sys/kernel/debug + grep -q debugfs /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime -t debugfs debugfs /sys/kernel/debug grep -q bpf /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime,mode=0700 -t bpf bpffs /sys/fs/bpf - grep -q pstore /proc/filesystems && /bin/mount -o noatime -t pstore pstore /sys/fs/pstore + grep -q pstore /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime -t pstore pstore /sys/fs/pstore [ "$FAILSAFE" = "true" ] && touch /tmp/.failsafe touch /tmp/.config_pending |