summary |
shortlog |
log |
commit | commitdiff |
tree
raw |
patch |
inline | side by side (from parent 1:
c2f1f19)
These options aren't mandatory, but can prevent some future
bugs from being exploited. Good reading:
http://lwn.net/Articles/647757/
Value chosen by looking at fedora 22 / ubuntu 14.04
Not tested yet (away from my tests routers)
Not touching jail/jail.c as this conflict with
my pending patch serie
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
{
unsigned int oldumask = umask(0);
{
unsigned int oldumask = umask(0);
- mount("proc", "/proc", "proc", MS_NOATIME, 0);
- mount("sysfs", "/sys", "sysfs", MS_NOATIME, 0);
- mount("none", "/sys/fs/cgroup", "cgroup", 0, 0);
- mount("tmpfs", "/dev", "tmpfs", MS_NOATIME, "mode=0755,size=512K");
+ mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("cgroup", "/sys/fs/cgroup", "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOSUID, "mode=0755,size=512K");
symlink("/tmp/shm", "/dev/shm");
mkdir("/dev/pts", 0755);
symlink("/tmp/shm", "/dev/shm");
mkdir("/dev/pts", 0755);
- mount("devpts", "/dev/pts", "devpts", MS_NOATIME, "mode=600");
+ mount("devpts", "/dev/pts", "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=600");
early_dev();
early_console("/dev/console");
if (mount_zram_on_tmp()) {
early_dev();
early_console("/dev/console");
if (mount_zram_on_tmp()) {
- mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, NULL);
+ mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, 0);
mkdir("/tmp/shm", 01777);
} else {
mkdir("/tmp/shm", 01777);
mkdir("/tmp/shm", 01777);
} else {
mkdir("/tmp/shm", 01777);
umount2("/dev/pts", MNT_DETACH);
umount2("/dev/", MNT_DETACH);
umount2("/dev/pts", MNT_DETACH);
umount2("/dev/", MNT_DETACH);
- mount("tmpfs", "/dev", "tmpfs", 0, "mode=0755,size=512K");
+ mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "mode=0755,size=512K");
symlink("/tmp/shm", "/dev/shm");
mkdir("/dev/pts", 0755);
umask(oldumask);
symlink("/tmp/shm", "/dev/shm");
mkdir("/dev/pts", 0755);
umask(oldumask);
- mount("devpts", "/dev/pts", "devpts", 0, 0);
+ mount("devpts", "/dev/pts", "devpts", MS_NOEXEC | MS_NOSUID, 0);
udevtrigger.cb = udevtrigger_complete;
udevtrigger.pid = fork();
if (!udevtrigger.pid) {
udevtrigger.cb = udevtrigger_complete;
udevtrigger.pid = fork();
if (!udevtrigger.pid) {