Hi all,
Attached to this email are the two libblockdev/udisks patches that we
sent to the linux-distros@openwall last week.
Thank you very much! We are at your disposal for questions, comments,
and further discussions.
With best regards,
--
the Qualys Security Advisory team
From 8e072f794744bd17c57cceabb3884d3f0f6a1602 Mon Sep 17 00:00:00 2001
From: Thomas Blume <thomas.bl...@suse.com>
Date: Fri, 16 May 2025 14:27:10 +0200
Subject: [PATCH] dont allow suid and dev set on fs resize
---
src/plugins/fs/generic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/plugins/fs/generic.c b/src/plugins/fs/generic.c
index 69333944..1a6dd960 100644
--- a/src/plugins/fs/generic.c
+++ b/src/plugins/fs/generic.c
@@ -683,7 +683,9 @@ static gchar* fs_mount (const gchar *device, gchar *fstype,
gboolean read_only,
"Failed to create temporary directory for
mounting '%s'.", device);
return NULL;
}
- ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "ro" :
NULL, NULL, &l_error);
+
+ ret = bd_fs_mount (device, mountpoint, fstype, read_only ?
"nosuid,nodev,ro" : "nosuid,nodev", NULL, &l_error);
+
if (!ret) {
g_propagate_prefixed_error (error, l_error, "Failed to mount
'%s': ", device);
g_rmdir (mountpoint);
--
2.48.1
From 0007d5616f4dbc9ccd65b9094ffc18c6f776d06a Mon Sep 17 00:00:00 2001
From: Tomas Bzatek <tbza...@redhat.com>
Date: Wed, 4 Jun 2025 15:26:46 +0200
Subject: [PATCH] udiskslinuxfilesystemhelpers: Mount private mounts with
'nodev,nosuid'
The private mount done in take_filesystem_ownership() should always
default to 'nodev,nosuid' for security and 'errors=remount-ro' for
selected filesystem to handle corrupted filesystem. This is consistent
with mount options calculation for regular mounts.
---
src/udiskslinuxfilesystemhelpers.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/udiskslinuxfilesystemhelpers.c
b/src/udiskslinuxfilesystemhelpers.c
index 7c5fc037..9eb7742c 100644
--- a/src/udiskslinuxfilesystemhelpers.c
+++ b/src/udiskslinuxfilesystemhelpers.c
@@ -123,6 +123,7 @@ take_filesystem_ownership (const gchar *device,
{
gchar *mountpoint = NULL;
+ const gchar *mount_opts;
GError *local_error = NULL;
gboolean unmount = FALSE;
gboolean success = TRUE;
@@ -151,8 +152,15 @@ take_filesystem_ownership (const gchar *device,
goto out;
}
+ mount_opts = "nodev,nosuid";
+ if (g_strcmp0 (fstype, "ext2") == 0 ||
+ g_strcmp0 (fstype, "ext3") == 0 ||
+ g_strcmp0 (fstype, "ext4") == 0 ||
+ g_strcmp0 (fstype, "jfs") == 0)
+ mount_opts = "nodev,nosuid,errors=remount-ro";
+
/* TODO: mount to a private mount namespace */
- if (!bd_fs_mount (device, mountpoint, fstype, NULL, NULL,
&local_error))
+ if (!bd_fs_mount (device, mountpoint, fstype, mount_opts, NULL,
&local_error))
{
g_set_error (error, UDISKS_ERROR, UDISKS_ERROR_FAILED,
"Cannot mount %s at %s: %s",
--
2.49.0
