diff options
| author | Hauke Mehrtens <hauke@hauke-m.de> | 2024-11-14 21:46:36 +0100 |
|---|---|---|
| committer | Christian Marangi <ansuelsmth@gmail.com> | 2024-11-16 14:23:08 +0100 |
| commit | b88d51898d126d2f918cb476d4158e9fcd62492c (patch) | |
| tree | 07db142b01e5bbc182ffaa70139e42ccc1023524 | |
| parent | 3b710375dd97af1e0416904c4174d11c51e3f09c (diff) | |
| download | openwrt-b88d51898d126d2f918cb476d4158e9fcd62492c.tar.gz openwrt-b88d51898d126d2f918cb476d4158e9fcd62492c.tar.bz2 openwrt-b88d51898d126d2f918cb476d4158e9fcd62492c.zip | |
base-files: Mount debugfs and pstore with nosuid,nodev,noexec
These permissions are not needed. Systemd also mounts these file systems
without these permissions on other Linux distributions.
Dropping these permissions should make the system more secure.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://github.com/openwrt/openwrt/pull/16960
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
| -rwxr-xr-x | package/base-files/files/etc/init.d/boot | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/package/base-files/files/etc/init.d/boot b/package/base-files/files/etc/init.d/boot index 332a5c96f3..a26d4886b2 100755 --- a/package/base-files/files/etc/init.d/boot +++ b/package/base-files/files/etc/init.d/boot @@ -35,9 +35,9 @@ boot() { mkdir -p /tmp/resolv.conf.d touch /tmp/resolv.conf.d/resolv.conf.auto ln -sf /tmp/resolv.conf.d/resolv.conf.auto /tmp/resolv.conf - grep -q debugfs /proc/filesystems && /bin/mount -o noatime -t debugfs debugfs /sys/kernel/debug + grep -q debugfs /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime -t debugfs debugfs /sys/kernel/debug grep -q bpf /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime,mode=0700 -t bpf bpffs /sys/fs/bpf - grep -q pstore /proc/filesystems && /bin/mount -o noatime -t pstore pstore /sys/fs/pstore + grep -q pstore /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime -t pstore pstore /sys/fs/pstore [ "$FAILSAFE" = "true" ] && touch /tmp/.failsafe touch /tmp/.config_pending |