Linux 5.17 Patch Can Help With Systemd-Less System Security, May Break Some Old Drivers
Written by Michael Larabel in Linux Security on 4 January 2022 at 04:48 AM EST. 3 Comments
LINUX SECURITY --
A decade old patch is set to be mainlined in the upcoming Linux 5.17 that has been carried by Google's Chrome OS kernel build for years and can help with security on Linux systems not relying upon systemd's udev.

The change is introducing the new "DEVTMPFS_SAFE" kernel option that will mount DEVTMPFS with the noexec and nosuid mount options by default. The intent of this "safe" devtmpfs is to prevent code execution from happening from /dev or more broadly to prevent some kinds of code execution attacks from happening primarily on embedded systems.

Systemd's udev already has a safeguard in place against /dev execution so this change will primarily benefit those not already using udev/systemd. But it is known that this safe mode will prevent /dev/mem from being mapped with the PROT_EXEC flag, which in turn can break things like old graphics drivers not supporting kernel mode-setting (KMS)... If you are on a Linux 5.17+ kernel, hopefully you are using a modern KMS-enabled driver and not some old bits like the neglected VIA UMS driver or other esoteric hardware/software combinations.


Google's Kees Cook added in the driver-core-next patch, "No sane program should be relying on executing from /dev. So this patch reduces the attack surface. It doesn't prevent any specific attack, but it reduces the possibility that someone can use /dev as a place to put executable code. Chrome OS has been carrying this patch for several years. It seems trivial and simple solution to improve the protection of /dev when CONFIG_DEVTMPFS_MOUNT=y."
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week