[systemd-devel] Mount options for $XDG_RUNTIME_DIR

[Leonid Isaev]

[Sorry, forgot to CC the mailing list]

Hi Lennart,

On Tue, 18 Mar 2014 02:33:50 +0100
Lennart Poettering <lennart at poettering.net> wrote:

> On Mon, 17.03.14 19:04, Leonid Isaev (lisaev at umail.iu.edu) wrote:
> 
> > Hi,
> > 
> > 	Currently, XDG_RUNTIME_DIR=/run/user/<UID> is mounted with rather
> > permissive, hardcoded mount options (or at least I couldn't find a
> > documented way of changing them). Specifically, a user is allowed to
> > execute things from his $XDG_RUNTIME_DIR. This effectively negates admin's
> > ability to constrain users, e.g. by mounting /home as noexec (I have seen
> > this done in some environments).
> > 	Is there a need to allow execution from $XDG_RUNTIME_DIR? And how
> > should one configure its mount options?
> 
> Yes, this is hardcoded in 211, that's true. We could make this
> configurable but I am not really convinced that we really want that?

I agree that a complete, fstab-like configuration may be too much.

> 
> I mean, the XDG_RUNTIME_DIR spec says the dir "must be fully-featured by
> the standards of the operating system. More specifically, ... proper
> permissions ... must be supported". I'd read that as if the x bit should
> do what it is supposed to do. So, in order to stay compatible with the
> spec allowing to mount it with noexec sounds undesirable.

Well, regardless of what the XDG specification says, the fact is that currently
each user has 2 /home's: one under the admin control, another -- not.

Of course, one could hook into PAM and remount each user's XDG_RUNTIME_DIR
upon login, but this is hacking around the init system... What about making
XDG_RUNTIME_DIR inherit mount options from /home if the latter is a separate
partition and fall back to the current default otherwise?

> 
> Moreover "noexec" is mostly snake-oil, isn't it? You can invoke the
> executables with an interpreter still, and you can copy the files
> elsewhere...

True for the interpreted code. However regarding other places, if an admin
cares about noexec at all, /var/tmp, /tmp and /dev/shm should be also
constrained (I am not saying that this should be the default, just
configurable).

Thanks,
Leonid.

> 
> Note that setting "noexec" on an fs means you cannot maps its files
> PROT_EXEC anymore, which breaks a number of things. In the past people
> attempted to mount /dev/shm as noexec, and dosemu broke because it made
> use of this. Then people wanted to mount /dev as noexec, which broke X11
> which wanted to map some device nodes PROT_EXEC. Given that we consider
> XDG_RUNTIME_DIR as a private version of /dev/shm among other things it
> really sounds wrong to break this right from the start.

> 
> So, I am not really convinced I must say...
> 
> Lennart
> 



-- 
Leonid Isaev
GPG key fingerprint: C0DF 20D0 C075 C3F1 E1BE  775A A7AE F6CB 164B 5A6D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/systemd-devel/attachments/20140318/7827418b/attachment.sig>