From 5cb02182fd875884ce27636e3c694705a525de94 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 25 Mar 2019 19:39:00 +0100 Subject: [PATCH 1/2] units: set nodev,nosuid,noexec flags for various secondary API VFS A couple of API VFS we mount via .mount units. Let's set the three flags for those too, just in case. This is just paranoia, nothing else, but shouldn't hurt. --- units/dev-mqueue.mount | 1 + units/proc-sys-fs-binfmt_misc.mount | 1 + units/sys-fs-fuse-connections.mount | 1 + units/sys-kernel-config.mount | 1 + units/sys-kernel-debug.mount | 1 + 5 files changed, 5 insertions(+) diff --git a/units/dev-mqueue.mount b/units/dev-mqueue.mount index be32433d6c..0114ad31f0 100644 --- a/units/dev-mqueue.mount +++ b/units/dev-mqueue.mount @@ -20,3 +20,4 @@ ConditionCapability=CAP_SYS_ADMIN What=mqueue Where=/dev/mqueue Type=mqueue +Options=nosuid,nodev,noexec diff --git a/units/proc-sys-fs-binfmt_misc.mount b/units/proc-sys-fs-binfmt_misc.mount index 091191e139..66229ec78e 100644 --- a/units/proc-sys-fs-binfmt_misc.mount +++ b/units/proc-sys-fs-binfmt_misc.mount @@ -17,3 +17,4 @@ DefaultDependencies=no What=binfmt_misc Where=/proc/sys/fs/binfmt_misc Type=binfmt_misc +Options=nosuid,nodev,noexec diff --git a/units/sys-fs-fuse-connections.mount b/units/sys-fs-fuse-connections.mount index 7e7b05c3a2..7bbc342be8 100644 --- a/units/sys-fs-fuse-connections.mount +++ b/units/sys-fs-fuse-connections.mount @@ -22,3 +22,4 @@ Before=sysinit.target What=fusectl Where=/sys/fs/fuse/connections Type=fusectl +Options=nosuid,nodev,noexec diff --git a/units/sys-kernel-config.mount b/units/sys-kernel-config.mount index e213ca58b3..e6997884dc 100644 --- a/units/sys-kernel-config.mount +++ b/units/sys-kernel-config.mount @@ -21,3 +21,4 @@ Before=sysinit.target What=configfs Where=/sys/kernel/config Type=configfs +Options=nosuid,nodev,noexec diff --git a/units/sys-kernel-debug.mount b/units/sys-kernel-debug.mount index 53ce820b87..618270ddae 100644 --- a/units/sys-kernel-debug.mount +++ b/units/sys-kernel-debug.mount @@ -20,3 +20,4 @@ Before=sysinit.target What=debugfs Where=/sys/kernel/debug Type=debugfs +Options=nosuid,nodev,noexec From 849b9b85b8faa5accc65ed13c871fbb772e7284d Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 25 Mar 2019 19:42:47 +0100 Subject: [PATCH 2/2] nspawn: mount mqueue with nodev,noexec,nosuid, too The host mounts it like that, nspawn hence should do too. Moreover, mount the file system after doing CLONEW_NEWIPC so that it actually reflects the right mqueues. Finally, mount it wthout considering it fatal, since POSIX mqueue support is little used and it should be fine not to support it in the kernel. --- src/nspawn/nspawn-mount.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index a3447d948a..81e3065227 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -580,6 +580,9 @@ int mount_all(const char *dest, PROC_READ_ONLY("/proc/irq"), PROC_READ_ONLY("/proc/scsi"), + { "mqueue", "/dev/mqueue", "mqueue", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, + MOUNT_IN_USERNS }, + /* Then we list outer child mounts (i.e. mounts applied *before* entering user namespacing) */ { "tmpfs", "/tmp", "tmpfs", "mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME, MOUNT_FATAL|MOUNT_APPLY_TMPFS_TMP }, @@ -595,8 +598,6 @@ int mount_all(const char *dest, MOUNT_FATAL }, { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, MOUNT_FATAL }, - { "mqueue", "/dev/mqueue", "mqueue", NULL, 0, - MOUNT_FATAL }, #if HAVE_SELINUX { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND,