Re: Creating executable device nodes in /dev?

--=-HfnQe6Xx6rBFLwlXKhP7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, 2020-12-09 at 07:14 -0800, Andy Lutomirski wrote:
> On Dec 9, 2020, at 12:58 AM, Topi Miettinen <[email protected]> wrote:
[...]
> > I think we agree that there's a need for either way to allow SGX
> > (if default is hardened) or a hardening option (in the opposite
> > case). For systemd I see two approaches:
> >=20
> > 1. Default noexec /dev, override with something like
> > - ExecPaths=3D/dev
> > - MountOptions=3D/dev:rw,exec,dev,nosuid
> > - or even MountOptions=3D/dev/sgx:rw,exec,dev,nosuid
> > - ProtectDev=3Dno
> > - AllowSGX=3Dyes
> >=20
> > 2. Default exec /dev, override with
> > - NoExecPaths=3D/dev
> > - MountOptions=3D/dev:rw,noexec,dev,nosuid
> > - ProtectDev=3Dyes
> > - DenySGX=3Dyes
> >=20
> > I'd prefer 1. but of course 2. would be reasonable.
>=20
> I would argue for 2, for the following reason.=C2=A0 I absolutely agree
> that hardening a system by making it impossible to create executable
> code dynamically is valuable, but I don=E2=80=99t think it=E2=80=99s a go=
od default.
> By default, programs like gcc and clang should work, but so should
> JITs, and JITs are getting more popular and powerful all the time.=C2=A0
> In a default setting that allows JITs, etc, I see no benefit at all
> to making /dev noexec. To the contrary, making /dev noexec seems like
> plugging a little restricted corner of code creation (because it
> requires UID=3D0) while allowing the easy ways (/tmp, /home, /dev/shm,
> unshare(2), mmap(), etc).=C2=A0 By all means let admins harden this, but =
I
> see no reason to apply some of the hardening when the rest is
> disabled.
[...]

I'm convinced.  I've committed a change to initramfs-tools that removes
the noexec mount option again.

Ben.

--=20
Ben Hutchings
It is a miracle that curiosity survives formal education.
                                                      - Albert Einstein

--=-HfnQe6Xx6rBFLwlXKhP7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAl/RSKMACgkQ57/I7JWG
EQnIXhAAwMUewts9rz++6N19HKsBEbAv2kN8kN/dmVvSi6A/d1oddTNZ/Mcn44jT
LBMdqTEr6igbZ+HtAQ/QwxQ8jMCiO6Acz2hRZbpdd/R2N8dsRbkuXc+OOQhsWW5O
p62AI9N6dhXCvEWRyCrFI4zTvS784bH9OYoIwP5EvEQqa/oYUSLXH2g4BJNE9AEq
TAYSql/v6jcD+TysYP4YC/mlnrb5S/rf/4Xtn/DBZE5nQguhsK6Vv0yR7i89Duq5
wuLi5IH4IeCF8Y/YXVi7IPV5RDOaSQx2MJxPjyQb0T5QlWwAs11IP3BwYTi+R5LB
BVveAO5uKN03zUbQXScSfEqwPXUiM5aywrMxenwrFkWGKcrFM142GnrVqsx236Kp
hc2iZWIxgOt1951LHJ52RCsaNu+zWD5juciWpeWTeIfKhDk2HflMuSHv4vh/Ls0b
k/dXJRGrDPAYCP1GXZlTyteIrurwsEWqdmcCdstY0LwZskoRyGqM3zJPkqJLENko
rwT+4ZAHaCgarq1yHIhAc/0w0ZZgfr93vJRAkq39ARIj3zhtpatKIUvVCzbyK3dD
JIsoV+f4Ah0SL71O3Vj23jJboQkeYLfFPuPNAN3SpoHMY5fgCKOPf56jBlqmAdEO
Zun04rAzfNUTF5SKIeMxS4qpQiYwz2vpJPPGuLVniX7svEGfa7U=
=B7xG
-----END PGP SIGNATURE-----

--=-HfnQe6Xx6rBFLwlXKhP7--