Re: [gentoo-dev] Making procfs mount as nosuid,noexec by default

[Ned Ludd]

On Sat, 2006-07-15 at 13:41 -0400, Ned Ludd wrote:
> On Sat, 2006-07-15 at 17:45 +0100, Daniel Drake wrote:
> > Hi,
> >
> > The local root exploit-of-the-week would have been unable to run if our
> > users systems had /proc mounted with nosuid and/or noexec
> >
> > It would be worthwhile considering making this a default. What are
> > people's thoughts?
>
> I mailed Mike about this very thing a month ago. Pretty sure it should
> be showing up in an upcoming baselayout. But yeah it's a good idea for
> the nosuid part anyway. Not 100% sure about the noexec part as that
> might break upx which calls /proc/self/exe as part of it's decompresser
> routines.

Tested it using a and it seems safe across the board. upx,busybox and 
other multicall binaries seem quite content. Linus also recently
suggested that the same be done in the kernel directly via the
proc_fill_super() function. This seems like an ideal route to go for us
as it would get inherited by all the existing users who wont notice 
the change in the default fstab file.

-- 
Ned Ludd <solar@g.o>
Gentoo Linux

-- 
gentoo-dev@g.o mailing list