From 9d6d28a6c2829fa11e4026f6fe0ec3ffc773e033 Mon Sep 17 00:00:00 2001 From: Andrea Righi Date: Fri, 20 May 2022 14:55:39 +0200 Subject: [PATCH] UBUNTU: [Config] enable CONFIG_DEVTMPFS_SAFE BugLink: https://bugs.launchpad.net/bugs/1974442 Mount devtmpfs with nosuid,noexec to prevent mmapping special files in /dev with PROT_EXEC or having executables setuid files. This allows to provide a little bit of extra security in the system. This change may potentially break some drivers that require to execute code by mmapping /dev/mem (e.g., non-KSM video drivers). Theoretically we shouldn't break any of the officially supported drivers, because kernel lockdown is already preventing access to /dev/mem. This is just a little more relaxed constraint than kernel lockdown, but it can still provide a reasonable level of extra security in the system also when the kernel is not completely locked down. Acked-by: Thadeu Lima de Souza Cascardo Signed-off-by: Andrea Righi --- debian.master/config/annotations | 1 + debian.master/config/config.common.ubuntu | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/debian.master/config/annotations b/debian.master/config/annotations index a0920e0f3fad..5a0e1ea742a8 100644 --- a/debian.master/config/annotations +++ b/debian.master/config/annotations @@ -1970,6 +1970,7 @@ CONFIG_UEVENT_HELPER policy<{'amd64': 'y', 'arm64': ' CONFIG_UEVENT_HELPER_PATH policy<{'amd64': '""', 'arm64': '""', 'armhf': '""', 'ppc64el': '""', 's390x': '""'}> CONFIG_DEVTMPFS policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_DEVTMPFS_MOUNT policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}> +CONFIG_DEVTMPFS_SAFE policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_STANDALONE policy<{'amd64': 'n', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_PREVENT_FIRMWARE_BUILD policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}> CONFIG_ALLOW_DEV_COREDUMP policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}> diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu index 28b5e855d7da..e6bf6cca79ce 100644 --- a/debian.master/config/config.common.ubuntu +++ b/debian.master/config/config.common.ubuntu @@ -2782,7 +2782,7 @@ CONFIG_DEVMEM=y CONFIG_DEVPORT=y CONFIG_DEVTMPFS=y CONFIG_DEVTMPFS_MOUNT=y -# CONFIG_DEVTMPFS_SAFE is not set +CONFIG_DEVTMPFS_SAFE=y CONFIG_DEV_APPLETALK=m CONFIG_DEV_COREDUMP=y CONFIG_DEV_DAX=m