From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jarkko Sakkinen Date: Wed, 09 Dec 2020 00:15:21 +0000 Subject: Re: Creating executable device nodes in /dev? Message-Id: <20201209001521.GA64007@kernel.org> List-Id: References: <0f17eade-5e99-be29-fd09-2d0a1949ac7f@gmail.com> <9DF5C88B-5156-455A-BA3F-EB19CAA0411B@amacapital.net> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Topi Miettinen Cc: Andy Lutomirski , Andy Lutomirski , Zbigniew =?utf-8?Q?J=C4=99drzejewski-Szmek?= , linux-hotplug@vger.kernel.org, systemd Mailing List , Jarkko Sakkinen , Jethro Beekman , Casey Schaufler , linux-sgx@vger.kernel.org, "Svahn, Kai" , "Schlobohm, Bruce" , Stephen Smalley , Haitao Huang , Ben Hutchings On Wed, Dec 09, 2020 at 01:15:27AM +0200, Topi Miettinen wrote: > > > > As a further argument, I just did this on a Fedora system: > > > > $ find /dev -perm /ugo+x -a \! -type d -a \! -type l > > > > No results. So making /dev noexec doesn't seem to have any benefit. > > > > > > It's no surprise that there aren't any executables in /dev since > > > removing MAKEDEV ages ago. That's not the issue, which is that > > > /dev is a writable directory (for UID=0 but no capabilities are > > > needed) and thus a potential location for constructing unapproved > > > executables if it is also mounted exec (W^X). > > > > UID 0 can just change mount options, though, unless SELinux or similar is used. And SELinux can protect /dev just fine without noexec. > > Well, mounting would need CAP_SYS_ADMIN in addition to UID 0. Also SELinux > is not universal and the policies might not contain all users or services. > > -Topi What's the data that supports having noexec /dev anyway? With root access I can then just use something else like /dev/shm mount. Has there been out in the wild real world cases that noexec mount of would have prevented? For me this sounds a lot just something that "feels more secure" without any measurable benefit. Can you prove me wrong? /Jarkko