{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/3216","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/3216/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/3216/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/3216/events","html_url":"https://github.com/systemd/systemd/pull/3216","id":153611967,"number":3216,"title":"namespace: Make private /dev noexec and readonly","user":{"login":"topimiettinen","id":18518033,"avatar_url":"https://avatars.githubusercontent.com/u/18518033?v=3","gravatar_id":"","url":"https://api.github.com/users/topimiettinen","html_url":"https://github.com/topimiettinen","followers_url":"https://api.github.com/users/topimiettinen/followers","following_url":"https://api.github.com/users/topimiettinen/following{/other_user}","gists_url":"https://api.github.com/users/topimiettinen/gists{/gist_id}","starred_url":"https://api.github.com/users/topimiettinen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/topimiettinen/subscriptions","organizations_url":"https://api.github.com/users/topimiettinen/orgs","repos_url":"https://api.github.com/users/topimiettinen/repos","events_url":"https://api.github.com/users/topimiettinen/events{/privacy}","received_events_url":"https://api.github.com/users/topimiettinen/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/systemd/systemd/labels/needs-reporter-feedback","name":"needs-reporter-feedback","color":"eb6420"},{"url":"https://api.github.com/repos/systemd/systemd/labels/pid1","name":"pid1","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-07T19:09:15Z","updated_at":"2016-05-09T15:59:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/systemd/systemd/pulls/3216","html_url":"https://github.com/systemd/systemd/pull/3216","diff_url":"https://github.com/systemd/systemd/pull/3216.diff","patch_url":"https://github.com/systemd/systemd/pull/3216.patch"},"body":"Private /dev will not be managed by udev or others, so we can make it\r\nnoexec and readonly after we have made all device nodes. As /dev/shm\r\nneeds to be writable, we can't use bind_remount_recursive()."},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/217907306","html_url":"https://github.com/systemd/systemd/pull/3216#issuecomment-217907306","issue_url":"https://api.github.com/repos/systemd/systemd/issues/3216","id":217907306,"user":{"login":"topimiettinen","id":18518033,"avatar_url":"https://avatars.githubusercontent.com/u/18518033?v=3","gravatar_id":"","url":"https://api.github.com/users/topimiettinen","html_url":"https://github.com/topimiettinen","followers_url":"https://api.github.com/users/topimiettinen/followers","following_url":"https://api.github.com/users/topimiettinen/following{/other_user}","gists_url":"https://api.github.com/users/topimiettinen/gists{/gist_id}","starred_url":"https://api.github.com/users/topimiettinen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/topimiettinen/subscriptions","organizations_url":"https://api.github.com/users/topimiettinen/orgs","repos_url":"https://api.github.com/users/topimiettinen/repos","events_url":"https://api.github.com/users/topimiettinen/events{/privacy}","received_events_url":"https://api.github.com/users/topimiettinen/received_events","type":"User","site_admin":false},"created_at":"2016-05-09T15:59:38Z","updated_at":"2016-05-09T15:59:38Z","body":"Writing to devices works with read-only /dev. You are right about PROT_EXEC, though it does not seems to be very common based on this old discussion about changing devtmpfs defaults to noexec;\r\nhttp://www.gossamer-threads.com/lists/linux/kernel/1633541\r\n\r\nAlso Chromium OS has had noexec /dev for some time:\r\nhttps://bugs.chromium.org/p/chromium/issues/detail?id=214855\r\n\r\nHere's a small test program:\r\n```\r\n#include <sys/types.h>\r\n#include <sys/stat.h>\r\n#include <fcntl.h>\r\n#include <unistd.h>\r\n#include <sys/mman.h>\r\n\r\nint main(void) {\r\n        int fd;\r\n\r\n        fd = open(\"/dev/zero\", O_RDWR);\r\n        write(fd, \"foo\", 3);\r\n        mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, fd, 0);\r\n        mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);\r\n        return 0;\r\n}\r\n```\r\n\r\nExcerpt of strace of the compiled program run with noexec /dev:\r\n```\r\nopen(\"/dev/zero\", O_RDWR)               = 3\r\nwrite(3, \"foo\", 3)                      = 3\r\nmmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 3, 0) = -1 EPERM (Operation not permitted)\r\nmmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc59d137000\r\n\r\n```\r\nExcerpt of strace with exec /dev:\r\n```\r\nopen(\"/dev/zero\", O_RDWR)               = 3\r\nwrite(3, \"foo\", 3)                      = 3\r\nmmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x7f476b290000\r\nmmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f476b28f000\r\n\r\n```\r\nStracing a few programs, including Java and qemu, do not show /dev/zero method to be used but MAP_ANONYMOUS method. I haven't had any problems either, with system services or with userspace (browser etc), with noexec /dev throughout the system. I've had it for a long time.\r\n\r\nBut if you want to be very conservative, I can change the patch to only remount /dev read-only.\r\n"}}