Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 7 Sep 2011 13:36:53 +0400
From: Solar Designer <solar@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: Re: /tmp fs type

Vasiliy,

On Wed, Sep 07, 2011 at 01:15:56PM +0400, Vasiliy Kulikov wrote:
> While we have an option to setup /tmp as tmpfs,

This is more than just an option - this is the current default.  And if
an admin overrides this default, then presumably they know what they're
doing.

> we probably should
> support bind mounts for /tmp (and /home?) to deny creating links to sxid
> binaries:

/tmp is already a separate filesystem.  As to /home, maybe.  But we're
planning to (re-)harden the kernel anyway, so why bother with partial
workarounds in userspace?  Just in case someone runs Owl userland with a
non-Owl kernel?

And what do you mean by "supporting" bind mounts?  Aren't they already
supported (with a trivial edit to fstab)?  Do you mean an installer
feature?  If so, I see no reason to provide it if it's just for those
who would use a non-Owl kernel - that is, people who are willing to
customize the system on their own.

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ