search

openSUSE / libpathrs

C-friendly API to make path resolution safer on Linux.
GNU Lesser General Public License v3.0
69 stars 6 forks source link

kernel hardening: block magic-link mounts #45

Open cyphar opened 2 months ago

cyphar commented 2 months ago

Al Viro responded favourably to blocking mounts over magic-links (or rather, mounts over "ethereal" components like everything in /proc/self/*), and this is fairly easy to implement. This would eliminate all concerns about races in procfs for kernels that support this.

cyphar commented 3 weeks ago

Christian and I wrote this series: https://lore.kernel.org/all/20240806-work-procfs-v1-0-fb04e1d09f0c@kernel.org/

The plan is to block more stuff in a future patch, but this is the "obvious stuff" to block.