From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <git@ipfire.org>
To: ipfire-scm@lists.ipfire.org
Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated.
 54bd60b67b477e5d5814293a74086dff1c21ac69
Date: Wed, 22 Jun 2022 12:25:48 +0000
Message-ID: <4LSjK91pKzz2y7l@people01.haj.ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5425013872602226023=="
List-Id: <ipfire-scm.lists.ipfire.org>

--===============5425013872602226023==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  54bd60b67b477e5d5814293a74086dff1c21ac69 (commit)
      from  29cf82e6fcdc4019901f9fb170abe44c131764be (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 54bd60b67b477e5d5814293a74086dff1c21ac69
Author: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
Date:   Wed Jun 22 12:23:10 2022 +0000

    Explicitly harden mount options of sensitive file systems
   =20
    These were found to got lost after upgrading to Core Update 169, so we
    set them explicitly to avoid accidential security downgrades.
   =20
    https://lists.ipfire.org/pipermail/development/2022-June/013714.html
   =20
    Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 src/initscripts/system/mountkernfs | 6 +++---
 src/initscripts/system/udev        | 5 ++---
 2 files changed, 5 insertions(+), 6 deletions(-)

Difference in files:
diff --git a/src/initscripts/system/mountkernfs b/src/initscripts/system/moun=
tkernfs
index d97b745be..b660083ec 100644
--- a/src/initscripts/system/mountkernfs
+++ b/src/initscripts/system/mountkernfs
@@ -28,17 +28,17 @@ case "${1}" in
=20
 		if ! mountpoint /proc &> /dev/null; then
 			boot_mesg -n " /proc" ${NORMAL}
-			mount -n -t proc /proc /proc || failed=3D1
+			mount -n -t proc -o nosuid,nodev,noexec /proc /proc || failed=3D1
 		fi
=20
 		if ! mountpoint /sys &> /dev/null; then
 			boot_mesg -n " /sys" ${NORMAL}
-			mount -n -t sysfs /sys /sys || failed=3D1
+			mount -n -t sysfs -o nosuid,nodev,noexec /sys /sys || failed=3D1
 		fi
=20
 		if ! mountpoint /run &> /dev/null; then
 			boot_mesg -n " /run" ${NORMAL}
-			mount -n -t tmpfs -o nosuid,nodev,mode=3D755,size=3D8M /run /run || faile=
d=3D1
+			mount -n -t tmpfs -o nosuid,nodev,noexec,mode=3D755,size=3D8M /run /run |=
| failed=3D1
 		fi
=20
 		if ! mountpoint /sys/fs/cgroup &> /dev/null; then
diff --git a/src/initscripts/system/udev b/src/initscripts/system/udev
index 2f6146e5d..b46ead196 100644
--- a/src/initscripts/system/udev
+++ b/src/initscripts/system/udev
@@ -50,12 +50,12 @@ case "${1}" in
=20
 		if ! grep -q '[[:space:]]/dev/shm' /proc/mounts; then
 			mkdir -p /dev/shm
-			mount -t tmpfs tmpfs /dev/shm
+			mount -t tmpfs tmpfs -o nosuid,nodev,noexec /dev/shm
 		fi
=20
 		if ! grep -q '[[:space:]]/dev/pts' /proc/mounts; then
 			mkdir -p /dev/pts
-			mount -t devpts devpts -o gid=3D5,mode=3D620 /dev/pts
+			mount -t devpts devpts -o nosuid,noexec,gid=3D5,mode=3D620 /dev/pts
 		fi
=20
 		# Start the udev daemon to continually watch for, and act on,
@@ -70,7 +70,6 @@ case "${1}" in
 		# Now wait for udevd to process the uevents we triggered
 		/bin/udevadm settle
 		evaluate_retval
-
 		;;
=20
 	restart)


hooks/post-receive
--
IPFire 2.x development tree

--===============5425013872602226023==--