Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

kernel hardening: block magic-link mounts #45

Open
cyphar opened this issue Jul 28, 2024 · 1 comment
Open

kernel hardening: block magic-link mounts #45

cyphar opened this issue Jul 28, 2024 · 1 comment
Labels
security A security issue or hardening problem. upstream/linux Dependent on upstream kernel work.

Comments

@cyphar
Copy link
Member

cyphar commented Jul 28, 2024

Al Viro responded favourably to blocking mounts over magic-links (or rather, mounts over "ethereal" components like everything in /proc/self/*), and this is fairly easy to implement. This would eliminate all concerns about races in procfs for kernels that support this.
@cyphar cyphar added security A security issue or hardening problem. upstream/linux Dependent on upstream kernel work. labels Jul 28, 2024
@cyphar
Copy link
Member Author

cyphar commented Sep 11, 2024 •
edited
Loading

Christian and I wrote this series: https://lore.kernel.org/all/[email protected]/

The plan is to block more stuff in a future patch, but this is the "obvious stuff" to block.

@cyphar cyphar mentioned this issue Sep 11, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security A security issue or hardening problem. upstream/linux Dependent on upstream kernel work.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@cyphar