Re: [gentoo-hardened] Request for Consideration: Kernel Patch to Improve Security for Bind Mounts

[Joshua Brindle]

AFAIK we had this at one time (at least read only binds which was made 
by albiero) whatever happened to that?

Joshua Brindle


Gavin wrote:

> Greetings,
>
> Currently, none of the Linux kernels available for Gentoo honor some of the mount options (e.g. read-only), when using bind-type mounts (e.g. "mount --bind ..").  Instead, these options are silently ignored (e.g. granting write access when read-only was requested).
>
> May I recommend this important patch for consideration in hardened-*sources?
>
> Herbert Poetzl's patch offers:
> o readonly bind mounts
> o ro truncate handling for (f)chown, (f)chmod handling
> o ro utime(s) handling
> o ro access and *_ioctl
> o added noatime and nodiratime
> o made autofs4 update_atime uncond
>
> Cheers,
> Gavin
>
> ----- Original Message -----
> From: "Herbert Poetzl" <herbert@×××××××××.at>
> To: <linux-kernel@×××××××××××.org>
> Sent: Wednesday, August 18, 2004 5:51 AM
> Subject: [PATCH] Bind Mount Extensions 0.05
>
>
>
>>Greetings!
>>
>>The following patch extends the 'noatime', 'nodiratime' and
>>last but not least the 'ro' (read only) mount option to the
>>vfs --bind mounts, allowing them to behave like any other
>>mount, by honoring those mount flags (which are silently
>>ignored by the current implementation in 2.4.x and 2.6.x)
>>
>>I don't want to pollute your mailbox with useless patches,
>>so for those who are interested in this stuff, get them
>>here (for 2.4.27 and 2.6.8.1)
>>
>>  http://www.13thfloor.at/patches/
>>
>>many thanks to Willy Tarreau for spotting the bug in the
>>previous bme0.04 for linux 2.4.x.
>>
>>enjoy,
>>Herbert
>>
>
>
> --
> gentoo-hardened@g.o mailing list
>
>


--
gentoo-hardened@g.o mailing list