(re-)mount home [and other?] with noexec (and nosuid [among other useful mount options]) for better security?

Development
,
10
2 Likes
11

There is --bind and --rbind. Looks like what we want is --rbind?

Need to make sure that the original mount is no longer accessible. For example if we mount /tmp on top of /tmp with more secure mount options, then the original /tmp must no longer be accessible. Is that the case or some trick how a non-root user could still access the original /tmp?

1 Like
12

Yes, that sounds like a good idea.

Not that I know of.

It would probably be unneeded complexity. I doubt most users would want to change the mount options.

I don’t think there’s any way to do that with just mount. We could grep the output of mount and if it isn’t there, leave out remount.

I don’t think there would be a big difference.

It should be the case. I don’t know of any way to access the original /tmp.

2 Likes
13

https://chromium.googlesource.com/chromiumos/docs/+/master/security/noexec_shell_scripts.md

mount /home -o remount,nodev,nosuid,noexec
2 Likes
14

https://www.cyberciti.biz/faq/howto-mount-tmp-as-separate-filesystem-with-noexec-nosuid-nodev/

https://secscan.acron.pl/centos7/1/1/17

2 Likes
15
2 Likes
16
2 Likes
17

ticket: lock down interpreters (interpreter lock)

2 Likes
18
1 Like
19

Fixes (noexec) and enhancements in git master and developers repository.

1 Like
20
1 Like
21

https://seifried.org/lasg/installation/

The “Filesystem layout and structuring” section has a table on which directories to use restrictive mount options on.

1 Like
22

Quote Kernel Hardening - security-misc - #328 by Patrick

1 Like
23
1 Like
24

I’ve refactored /usr/lib/security-misc/remount-secure. Should now be quite easy to add new remounts.

https://github.com/Whonix/security-misc/blob/master/usr/lib/security-misc/remount-secure#L83-L113

1 Like
25

This is causing many issues.

user@debian-buster-test:~$ sudo iptables --list
iptables/1.8.2 Failed to initialize nft: Protocol not supported

lsmod shows that fewer modules are load. And module auto loading is broken. This breaks Whonix firewall. Will therefore disable remounting /lib with nosuid,nodev. But no security reduction. There are no devices and no suid in /lib anyhow. And permission hardening was speed up so that parsing /lib in permission hardening is ok.

Linux Kernel Runtime Guard (LKRG) - Linux Kernel Runtime Integrity Checking and Exploit Detection - #16 by Patrick can also cause iptables/1.8.2 Failed to initialize nft: Protocol not supported

1 Like
26

These two things must not run together.

Dec 29 04:17:12 debian-buster-test remount-secure[410]: mount -o nosuid,nodev --bind /tmp /tmp

Dec 29 04:17:12 debian-buster-test permission-hardening[413]: /usr/lib/security-misc/permission-hardening: line 255: cannot create temp file for here-document: No such file or directory
Dec 29 04:17:12 debian-buster-test permission-hardening[413]: ERROR: cannot parse line: /usr/bin/sudo exactwhitelist

Can cause issues such as this:

How can a systemd unit alone without any others being executed at the very same time?

1 Like
27

This needs a revision.

systemd unit file to remount /home /tmp /dev/shm /run with nosuid,nodev

1 Like
28

/run/user/1000 bypasses /run’s noexec as it is its own mount point. We might want to look into restricting that too.

It could be useful to mount /dev with noexec.

We should experiment with the ro mount option to mount directories as read-only. /sys would be a good one for this as most things don’t need to write to it.

More mount points we can restrict are:

mqueue on /dev/mqueue type mqueue (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,pagesize=2M)

CLIP OS’s fstab is here products_clipos/40_fstab.sh at master · clipos/products_clipos · GitHub

1 Like
29

I can merge that but it won’t help much. The current implementation is a dead-end. It’s needs to be replaced entirely. See my previous post. There I link to my question, the bug description and reply by systemd.

1 Like