Linux 5.17 Patch Can Help With Systemd-Less System Security, May Break Some Old Drivers

A decade old patch is set to be mainlined in the upcoming Linux 5.17 that has been carried by Google's Chrome OS kernel build for years and can help with security on Linux systems not relying upon systemd's udev.

The change is introducing the new "DEVTMPFS_SAFE" kernel option that will mount DEVTMPFS with the noexec and nosuid mount options by default. The intent of this "safe" devtmpfs is to prevent code execution from happening from /dev or more broadly to prevent some kinds of code execution attacks from happening primarily on embedded systems.

Systemd's udev already has a safeguard in place against /dev execution so this change will primarily benefit those not already using udev/systemd. But it is known that this safe mode will prevent /dev/mem from being mapped with the PROT_EXEC flag, which in turn can break things like old graphics drivers not supporting kernel mode-setting (KMS)... If you are on a Linux 5.17+ kernel, hopefully you are using a modern KMS-enabled driver and not some old bits like the neglected VIA UMS driver or other esoteric hardware/software combinations.

Google's Kees Cook added in the driver-core-next patch, "No sane program should be relying on executing from /dev. So this patch reduces the attack surface. It doesn't prevent any specific attack, but it reduces the possibility that someone can use /dev as a place to put executable code. Chrome OS has been carrying this patch for several years. It seems trivial and simple solution to improve the protection of /dev when CONFIG_DEVTMPFS_MOUNT=y."