Re: Various mount options have changed in Core Update 169

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2180 bytes --]

Hello,

I suppose this is coming from changing dracut.

Unless I am reading your diff wrong, those options have been added which is a good thing?!

-Michael

> On 20 Jun 2022, at 21:34, Peter Müller <peter.mueller(a)ipfire.org> wrote:
> 
> Hello *,
> 
> while pre-testing Core Update 169, it came to my attention that, for some reason,
> various mount options have changed since Core Update 168, lacking options such as
> "nodev", "noexec", "nosuid", which means a security downgrade.
> 
> The complete delta is as follows:
> 
> $ diff -Naur before after
> --- before	2022-06-20 20:04:32.436632074 +0000
> +++ after	2022-06-20 20:04:34.500401575 +0000
> @@ -1,12 +1,12 @@
> -devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620,ptmxmode=000)
> +devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
> /dev/sda1 on /boot type ext4 (rw,relatime)
> /dev/sda2 on /boot/efi type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro)
> /dev/sda4 on / type ext4 (rw,relatime)
> -devtmpfs on /dev type devtmpfs (rw,relatime,size=1963708k,nr_inodes=490927,mode=755)
> +devtmpfs on /dev type devtmpfs (rw,nosuid,noexec,size=1949992k,nr_inodes=487498,mode=755)
> efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,relatime)
> none on /sys/fs/cgroup type cgroup2 (rw,relatime)
> -/proc on /proc type proc (rw,relatime)
> -/run on /run type tmpfs (rw,nosuid,nodev,relatime,size=8192k,mode=755)
> -/sys on /sys type sysfs (rw,relatime)
> -tmpfs on /dev/shm type tmpfs (rw,relatime)
> +proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
> +sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
> +tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,noexec)
> +tmpfs on /run type tmpfs (rw,nosuid,nodev,noexec,mode=755)
> /var/lock on /var/lock type tmpfs (rw,nosuid,nodev,relatime,size=8192k)
> 
> I cannot recall of having this explicitly changed anywhere, and don't understand
> the root cause for this (unwanted) change. Could somebody please point me into the
> right direction? :-)
> 
> Thanks in advance, and best regards,
> Peter Müller