touch-packages team mailing list archive

[Martin Pitt <martin.pitt@xxxxxxxxxx>]

Applied the udev.init change in http://anonscm.debian.org/cgit/pkg-
systemd/systemd.git/commit/?id=63dff1e2132b for Debian. But it is
totally irrelevant for Ubuntu, as we don't support SysV init. Under
upstart /etc/init/udev does not do any mounting, it relies on mountall
to do that, thus this needs to be added to /lib/init/fstab. systemd
already mounts it with MS_NOSUID (but not with MS_NOEXEC).

But in all cases the dominating and important thing here is initramfs-
tools, where /dev is usually mounted.

** Changed in: systemd (Ubuntu)
       Status: Triaged => Invalid

** Also affects: initramfs-tools (Ubuntu)
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to lxc in Ubuntu.
https://bugs.launchpad.net/bugs/1450960

Title:
  dev file system is mounted without noexec

Status in initramfs-tools package in Ubuntu:
  New
Status in lxc package in Ubuntu:
  Confirmed
Status in systemd package in Ubuntu:
  Invalid

Bug description:
  I just found that the /dev filesystem of most Ubuntu system is mounted
  without noexec, nosuid etc options.

  If you do everything to harden your system, and you are using squashfs
  as root file system (which is read-only), such auto-mounted devices
  can be a serious leak.

  This volume usually is quite small and for most folders only root has
  write access, so I don't know how much this bug is security relevant,
  but I think there is no reason to not change the mount options for
  /dev. And especially for LXC containers, I don't even know a
  workaround to fix it.

  STEPS TO REPRODUCE:

  me:~# cat >/dev/call-me.sh <<.e
  > #!/bin/sh
  > echo "I'm executable"
  > .e

  me:~# chmod +x /dev/call-me.sh

  me:~# /dev/call-me.sh
  I'm executable

  EXPECTED BEHAVIOUR

  me:~# /dev/call-me.sh
  -bash: /dev/call-me.sh: Permission denied

  WORKAROUND

  me:~# mount -oremount,noexec,nosuid /dev

  me:~# /dev/call-me.sh
  -bash: /dev/call-me.sh: Permission denied

  Unfortunately, this workaround doesn't work in LXC containers (where
  the same problem occurs) because of missing capabilities.

  ProblemType: Bug
  DistroRelease: Ubuntu 14.04
  Package: udev 204-5ubuntu20.11
  ProcVersionSignature: Ubuntu 3.13.0-49.83-generic 3.13.11-ckt17
  Uname: Linux 3.13.0-49-generic x86_64
  ApportVersion: 2.14.1-0ubuntu3.10
  Architecture: amd64
  CurrentDesktop: XFCE
  CurrentDmesg: Error: command ['sh', '-c', 'dmesg | comm -13 --nocheck-order /var/log/dmesg -'] failed with exit code 1: comm: /var/log/dmesg: Permission denied
  CustomUdevRuleFiles: 51-android.rules 60-vboxdrv.rules
  Date: Sat May  2 01:48:26 2015
  MachineType: Gigabyte Technology Co., Ltd. H97-HD3
  ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.13.0-49-generic root=/dev/mapper/vg_ssd-lv_system_trusty1404 ro
  SourcePackage: systemd
  UpgradeStatus: Upgraded to trusty on 2014-04-18 (378 days ago)
  dmi.bios.date: 06/26/2014
  dmi.bios.vendor: American Megatrends Inc.
  dmi.bios.version: F5
  dmi.board.asset.tag: To be filled by O.E.M.
  dmi.board.name: H97-HD3
  dmi.board.vendor: Gigabyte Technology Co., Ltd.
  dmi.board.version: x.x
  dmi.chassis.asset.tag: To Be Filled By O.E.M.
  dmi.chassis.type: 3
  dmi.chassis.vendor: Gigabyte Technology Co., Ltd.
  dmi.chassis.version: To Be Filled By O.E.M.
  dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrF5:bd06/26/2014:svnGigabyteTechnologyCo.,Ltd.:pnH97-HD3:pvrTobefilledbyO.E.M.:rvnGigabyteTechnologyCo.,Ltd.:rnH97-HD3:rvrx.x:cvnGigabyteTechnologyCo.,Ltd.:ct3:cvrToBeFilledByO.E.M.:
  dmi.product.name: H97-HD3
  dmi.product.version: To be filled by O.E.M.
  dmi.sys.vendor: Gigabyte Technology Co., Ltd.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1450960/+subscriptions