From: Elly Fong-Jones Date: Wed, 14 Nov 2012 23:04:54 +0000 (-0500) Subject: CHROMIUM: add DEVTMPFS_SAFE support X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=4d6e50de1b7920d579efa7a086030fcf5ee42329;p=people%2Faperard%2Flinux-chromebook.git CHROMIUM: add DEVTMPFS_SAFE support If DEVTMPFS_SAFE==y, automount devtmpfs with nosuid and noexec. BUG=chromium-os:32629 TEST=adhoc mount | grep devtmpfs Change-Id: I7a330fb7bd1e0da7e42fe2194a958c6878c0ce68 Signed-off-by: Elizabeth Fong-Jones Reviewed-on: https://gerrit.chromium.org/gerrit/38061 Reviewed-by: Olof Johansson --- diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig index ae1d84b05c33d..1a4bba3bf2018 100644 --- a/drivers/base/Kconfig +++ b/drivers/base/Kconfig @@ -56,6 +56,15 @@ config DEVTMPFS_MOUNT rescue mode with init=/bin/sh, even when the /dev directory on the rootfs is completely empty. +config DEVTMPFS_SAFE + bool "Automount devtmpfs with nosuid/noexec" + depends on DEVTMPFS_MOUNT + default y + help + This instructs the kernel to automount devtmpfs with the + MS_NOEXEC and MS_NOSUID mount flags, which can prevent + certain kinds of code-execution attack on embedded platforms. + config STANDALONE bool "Select only drivers that don't need compile-time external firmware" if EXPERIMENTAL default y diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c index 8493536ea55b1..958e24dfd4dfe 100644 --- a/drivers/base/devtmpfs.c +++ b/drivers/base/devtmpfs.c @@ -361,6 +361,7 @@ static int handle_remove(const char *nodename, struct device *dev) int devtmpfs_mount(const char *mntdir) { int err; + int mflags = MS_SILENT; if (!mount_dev) return 0; @@ -368,7 +369,10 @@ int devtmpfs_mount(const char *mntdir) if (!thread) return 0; - err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL); +#ifdef CONFIG_DEVTMPFS_SAFE + mflags |= MS_NOEXEC | MS_NOSUID; +#endif + err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", mflags, NULL); if (err) printk(KERN_INFO "devtmpfs: error mounting %i\n", err); else