Workaround: remount /proc nosuid,noexec [LWN.net]

Workaround: remount /proc nosuid,noexec

Posted Jul 16, 2006 9:43 UTC (Sun) by Duncan (guest, #6647)
In reply to: Lots more kernel releases by NightMonkey
Parent article: Lots more kernel releases

On the Gentoo-devel list, which I follow as I run Gentoo and want to get a
heads-up on things coming down the pike, one of the kernel guys said it
wouldn't affect anyone who has /proc mounted nosuid,noexec. A bit of
testing later and they hadn't found any reason /not/ to do so (there was
speculation about a couple things but it turned out they worked fine
anyway), and I've been running that way for several hours, now, tho I did
update the kernel and it happened to be convenient to reboot at the time
so I did.

For anyone depending on the local security, I'd still recommend
double-checking it as I don't know enough about it to verify it myself,
but doing a /proc remount nosuid,noexec might be a useful workaround for
those who find it inconvenient to reboot ATM. That's how I have fstab
configured to (re)mount it, now, as it seems to make sense in any case,
and Gentoo will probably be making that the default in the next
baselayout, as well.

Duncan

(Log in to post comments)

Workaround: remount /proc nosuid,noexec

Posted Jul 16, 2006 21:36 UTC (Sun) by NightMonkey (subscriber, #23051) [Link]

Perhaps not even a reboot is neeeded? I just did this:

mount -o remount,nosuid,noexec /proc

Then, "mount" shows:

proc on /proc type proc (rw,noexec,nosuid)

Any drawbacks?

Workaround: remount /proc nosuid,noexec

Posted Jul 16, 2006 23:36 UTC (Sun) by Los__D (subscriber, #15263) [Link]

That was exactly what he said: "but doing a /proc remount nosuid,noexec might be a useful workaround for those who find it inconvenient to reboot ATM" :)

Workaround: remount /proc nosuid,noexec

Posted Jul 16, 2006 23:43 UTC (Sun) by NightMonkey (subscriber, #23051) [Link]

Your right. And I HAD my coffee. Uh oh.

Workaround: remount /proc nosuid,noexec

Posted Jul 17, 2006 16:14 UTC (Mon) by djrom (subscriber, #26074) [Link]

As usual, when someone suggests "noexec" for solving a security problem, it's not really a solution. It can't harm to do it anyway, but it's pretty easy to bypass. Just replace "/proc/executable" by "/lib/ld-linux.so.2 /proc/executable" and the exploit will work without a glitch.

Nope

Posted Jul 17, 2006 21:05 UTC (Mon) by JoeBuck (subscriber, #2330) [Link]

The exploit evidently is blocked if /proc is mounted nosuid. noexec has no effect.

Nope

Posted Jul 17, 2006 23:10 UTC (Mon) by djrom (subscriber, #26074) [Link]

Oops, I didn't checked for this precise exploit. I still think it's good to have it reminded as a general information on the usefulness of noexec mount option, but I stand corrected about for the exploit we were talking about :)