linux-kernel - Re: [PATCH v3] devtmpfs: mount with noexec and nosuid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 21 Nov 2012 00:05:10 +0000
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Kees Cook <keescook@...omium.org>
Cc:	linux-kernel@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	ellyjones@...omium.org, Kay Sievers <kay@...y.org>,
	Roland Eggner <edvx1@...temanalysen.net>
Subject: Re: [PATCH v3] devtmpfs: mount with noexec and nosuid

> +config DEVTMPFS_SAFE
> +	bool "Use nosuid,noexec mount options on devtmpfs"
> +	depends on DEVTMPFS
> +	help
> +	  This instructs the kernel to include the MS_NOEXEC and
> +	  MS_NOSUID mount flags when mounting devtmpfs. This prevents
> +	  certain kinds of code-execution attacks on embedded platforms.

This description appears to be wrong as well as the code being pointless.
It doesn't prevent any meaningful code execution attacks and the config
entry might give people the delusion its useful or a security feature.

Please provide a valid and meaningful example.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/