This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 54bd60b67b477e5d5814293a74086dff1c21ac69 (commit) from 29cf82e6fcdc4019901f9fb170abe44c131764be (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 54bd60b67b477e5d5814293a74086dff1c21ac69 Author: Peter Müller peter.mueller@ipfire.org Date: Wed Jun 22 12:23:10 2022 +0000

Explicitly harden mount options of sensitive file systems

These were found to got lost after upgrading to Core Update 169, so we set them explicitly to avoid accidential security downgrades.

https://lists.ipfire.org/pipermail/development/2022-June/013714.html

Signed-off-by: Peter Müller peter.mueller@ipfire.org

-----------------------------------------------------------------------

Summary of changes: src/initscripts/system/mountkernfs | 6 +++--- src/initscripts/system/udev | 5 ++--- 2 files changed, 5 insertions(+), 6 deletions(-)

Difference in files: diff --git a/src/initscripts/system/mountkernfs b/src/initscripts/system/mountkernfs index d97b745be..b660083ec 100644 --- a/src/initscripts/system/mountkernfs +++ b/src/initscripts/system/mountkernfs @@ -28,17 +28,17 @@ case "${1}" in

if ! mountpoint /proc &> /dev/null; then boot_mesg -n " /proc" ${NORMAL} - mount -n -t proc /proc /proc || failed=1 + mount -n -t proc -o nosuid,nodev,noexec /proc /proc || failed=1 fi

if ! mountpoint /sys &> /dev/null; then boot_mesg -n " /sys" ${NORMAL} - mount -n -t sysfs /sys /sys || failed=1 + mount -n -t sysfs -o nosuid,nodev,noexec /sys /sys || failed=1 fi

if ! mountpoint /run &> /dev/null; then boot_mesg -n " /run" ${NORMAL} - mount -n -t tmpfs -o nosuid,nodev,mode=755,size=8M /run /run || failed=1 + mount -n -t tmpfs -o nosuid,nodev,noexec,mode=755,size=8M /run /run || failed=1 fi

if ! mountpoint /sys/fs/cgroup &> /dev/null; then diff --git a/src/initscripts/system/udev b/src/initscripts/system/udev index 2f6146e5d..b46ead196 100644 --- a/src/initscripts/system/udev +++ b/src/initscripts/system/udev @@ -50,12 +50,12 @@ case "${1}" in

if ! grep -q '[[:space:]]/dev/shm' /proc/mounts; then mkdir -p /dev/shm - mount -t tmpfs tmpfs /dev/shm + mount -t tmpfs tmpfs -o nosuid,nodev,noexec /dev/shm fi

if ! grep -q '[[:space:]]/dev/pts' /proc/mounts; then mkdir -p /dev/pts - mount -t devpts devpts -o gid=5,mode=620 /dev/pts + mount -t devpts devpts -o nosuid,noexec,gid=5,mode=620 /dev/pts fi

# Start the udev daemon to continually watch for, and act on, @@ -70,7 +70,6 @@ case "${1}" in # Now wait for udevd to process the uevents we triggered /bin/udevadm settle evaluate_retval - ;;

restart)

hooks/post-receive -- IPFire 2.x development tree