ACK/Cmnt: [PATCH 0/4][v2 Focal/Jammy linux] dev file system is mounted without nosuid or noexec

[Andrea Righi]

On Tue, Oct 11, 2022 at 10:29:08AM -0600, Tim Gardner wrote:
> BugLink: https://bugs.launchpad.net/bugs/1991975
> Good test results in https://lists.ubuntu.com/archives/kernel-team/2022-October/133764.html
> 
> [ SRU TEMPLATE ]
> [ Impact ]
> 
>  * nosuid, and noexec bits are not set on /dev
>  * This has the potential for nefarious actors to use this as an avenue for attack.
>  * see https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1450960 for more discussion around this.
>  * It is not best security practice.
> 
> [ Test Plan ]
> 
>    1.Boot a Canonical Supplied EC2 instance
>    2.Check the mount options for /dev.
>    3.You will notice the lack of nosuid and noexec on /dev.
> 
> [ Where problems could occur ]
> 
>  * As of 2022/10/06, I need to test this, but don't know how to build -aws flavored ubuntu kernels.
>  * Instructions welcome. I'm holding off on adding SRU tags until I can actually get this tested.
> 
>  * If this is applied to non initramfs-less kernels it could potentially cause a regression for
>  * very old hardware that does nefarious things with memory. For a larger discussion about that see:
>  * https://lore.kernel.org/lkml/YcMfDOyrg647RCmd@debian-BULLSEYE-live-builder-AMD64/T/
> 
>  * Low risk if a driver depends on /dev allowing suid or exec this might prevent boot. That being said,
>  * all kernels that have been booting with an initramfs have been getting nosuid, and noexec set so
>  * hopefully we can consider that risk fairly well tested.
> 
> [ Other Info ]
> 
>  * Patch is accepted into 5.17, and will drop out quickly
>  * Any server booting with an initramfs already has nosuid, and noexec set, so hopefully

Looks good to me.

However, I noticed that on kinetic /dev is still mounted with exec
instead of noexec, even if we have DEVTMPFS_SAFE enabled. I'm wondering
if systemd is doing something fishy to remount /dev with the exec bit
set...

Have you checked if it's the same also on focal and jammy with this
patch set applied?

Acked-by: Andrea Righi <andrea.righi at canonical.com>