CHROMIUM: add DEVTMPFS_SAFE support

If DEVTMPFS_SAFE==y, automount devtmpfs with nosuid and noexec.

BUG=chromium-os:32629
TEST=adhoc
mount | grep devtmpfs

Change-Id: I7a330fb7bd1e0da7e42fe2194a958c6878c0ce68
Signed-off-by: Elizabeth Fong-Jones <ellyjones@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/38061
Reviewed-by: Olof Johansson <olofj@chromium.org>

diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index ae1d84b05c33d5ffcf8d855e473674bc2b36876d..1a4bba3bf20189ad5c607a629e474e3e1a903c51 100644 (file)
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -56,6 +56,15 @@ config DEVTMPFS_MOUNT
          rescue mode with init=/bin/sh, even when the /dev directory
          on the rootfs is completely empty.
 
+config DEVTMPFS_SAFE
+       bool "Automount devtmpfs with nosuid/noexec"
+       depends on DEVTMPFS_MOUNT
+       default y
+       help
+         This instructs the kernel to automount devtmpfs with the
+         MS_NOEXEC and MS_NOSUID mount flags, which can prevent
+         certain kinds of code-execution attack on embedded platforms.
+
 config STANDALONE
        bool "Select only drivers that don't need compile-time external firmware" if EXPERIMENTAL
        default y

diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
index 8493536ea55b1cc3a732d78565385db351d01d35..958e24dfd4dfe446d8a27f475b814b773e54ab37 100644 (file)
--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -361,6 +361,7 @@ static int handle_remove(const char *nodename, struct device *dev)
 int devtmpfs_mount(const char *mntdir)
 {
        int err;
+       int mflags = MS_SILENT;
 
        if (!mount_dev)
                return 0;
@@ -368,7 +369,10 @@ int devtmpfs_mount(const char *mntdir)
        if (!thread)
                return 0;
 
-       err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
+#ifdef CONFIG_DEVTMPFS_SAFE
+       mflags |= MS_NOEXEC | MS_NOSUID;
+#endif
+       err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", mflags, NULL);
        if (err)
                printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
        else