[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 54bd60b67b477e5d5814293a74086dff1c21ac69

["Peter Müller" <git@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 3224 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  54bd60b67b477e5d5814293a74086dff1c21ac69 (commit)
      from  29cf82e6fcdc4019901f9fb170abe44c131764be (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 54bd60b67b477e5d5814293a74086dff1c21ac69
Author: Peter Müller <peter.mueller(a)ipfire.org>
Date:   Wed Jun 22 12:23:10 2022 +0000

    Explicitly harden mount options of sensitive file systems
    
    These were found to got lost after upgrading to Core Update 169, so we
    set them explicitly to avoid accidential security downgrades.
    
    https://lists.ipfire.org/pipermail/development/2022-June/013714.html
    
    Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 src/initscripts/system/mountkernfs | 6 +++---
 src/initscripts/system/udev        | 5 ++---
 2 files changed, 5 insertions(+), 6 deletions(-)

Difference in files:
diff --git a/src/initscripts/system/mountkernfs b/src/initscripts/system/mountkernfs
index d97b745be..b660083ec 100644
--- a/src/initscripts/system/mountkernfs
+++ b/src/initscripts/system/mountkernfs
@@ -28,17 +28,17 @@ case "${1}" in
 
 		if ! mountpoint /proc &> /dev/null; then
 			boot_mesg -n " /proc" ${NORMAL}
-			mount -n -t proc /proc /proc || failed=1
+			mount -n -t proc -o nosuid,nodev,noexec /proc /proc || failed=1
 		fi
 
 		if ! mountpoint /sys &> /dev/null; then
 			boot_mesg -n " /sys" ${NORMAL}
-			mount -n -t sysfs /sys /sys || failed=1
+			mount -n -t sysfs -o nosuid,nodev,noexec /sys /sys || failed=1
 		fi
 
 		if ! mountpoint /run &> /dev/null; then
 			boot_mesg -n " /run" ${NORMAL}
-			mount -n -t tmpfs -o nosuid,nodev,mode=755,size=8M /run /run || failed=1
+			mount -n -t tmpfs -o nosuid,nodev,noexec,mode=755,size=8M /run /run || failed=1
 		fi
 
 		if ! mountpoint /sys/fs/cgroup &> /dev/null; then
diff --git a/src/initscripts/system/udev b/src/initscripts/system/udev
index 2f6146e5d..b46ead196 100644
--- a/src/initscripts/system/udev
+++ b/src/initscripts/system/udev
@@ -50,12 +50,12 @@ case "${1}" in
 
 		if ! grep -q '[[:space:]]/dev/shm' /proc/mounts; then
 			mkdir -p /dev/shm
-			mount -t tmpfs tmpfs /dev/shm
+			mount -t tmpfs tmpfs -o nosuid,nodev,noexec /dev/shm
 		fi
 
 		if ! grep -q '[[:space:]]/dev/pts' /proc/mounts; then
 			mkdir -p /dev/pts
-			mount -t devpts devpts -o gid=5,mode=620 /dev/pts
+			mount -t devpts devpts -o nosuid,noexec,gid=5,mode=620 /dev/pts
 		fi
 
 		# Start the udev daemon to continually watch for, and act on,
@@ -70,7 +70,6 @@ case "${1}" in
 		# Now wait for udevd to process the uevents we triggered
 		/bin/udevadm settle
 		evaluate_retval
-
 		;;
 
 	restart)


hooks/post-receive
--
IPFire 2.x development tree