diff options
| author | Lennart Poettering <lennart@poettering.net> | 2023-05-02 10:44:14 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2023-05-02 12:06:03 +0200 |
| commit | 7243cefec10ecab1248a26f443b797a8655fc14d (patch) | |
| tree | 95b2aa55fd095bb2916e7590031c7b264cced260 /src/shared | |
| parent | ab13274a19ee310ed8569612a862b977d054ed6c (diff) | |
| download | systemd-7243cefec10ecab1248a26f443b797a8655fc14d.tar.gz | |
base-filesystem: create /proc, /sys, /dev mount points as 0555
These inodes are going to be overmounted anyway, hence let's create them
with access mode 555, so that they are as close to being immutable as
regular UNIX access modes allow them to be. In other words: this takes
the "w" mode away for root. This of course usually has little effect --
unless CAP_DAC_OVERRIDE is dropped. But at the very least it makes the
point clear that inodes should be considered immutable.
(I intended to make this 0000 originally, but that doesn't work, as many
tools – including our own – have fallback paths that when they see
ENOENT in /proc/ they can handle this gracefully. But changing the mode
to 000 would turn this to EACCES - something they usually have no
fallback path for)
Diffstat (limited to 'src/shared')
| -rw-r--r-- | src/shared/base-filesystem.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/shared/base-filesystem.c b/src/shared/base-filesystem.c index 5890f30383..f2161041c8 100644 --- a/src/shared/base-filesystem.c +++ b/src/shared/base-filesystem.c @@ -36,9 +36,9 @@ static const BaseFilesystem table[] = { { "usr", 0755, NULL, NULL }, { "var", 0755, NULL, NULL }, { "etc", 0755, NULL, NULL }, - { "proc", 0755, NULL, NULL, true }, - { "sys", 0755, NULL, NULL, true }, - { "dev", 0755, NULL, NULL, true }, + { "proc", 0555, NULL, NULL, true }, + { "sys", 0555, NULL, NULL, true }, + { "dev", 0555, NULL, NULL, true }, /* Various architecture ABIs define the path to the dynamic loader via the /lib64/ subdirectory of * the root directory. When booting from an otherwise empty root file system (where only /usr/ has |