enable CONFIG_DEVTMPFS_SAFE

[Andrea Righi]

[Impact]

Use nosuid,noexec mount options on devtmpfs, this allows to provide a bit of extra security by preventing mmapping stuff in /dev with PROT_EXEC or having setuid executables.

[Test case]

If we really want to provide a test case for this...:

 $ grep devtmpfs /proc/mounts

We should see nosuid,noexec in the mount options if this change is applied, otherwise we should only see nosuid (or none of the above).

[Fix]

Enable CONFIG_DEVTMPFS_SAFE.

[Regression potential]

This change can potentially break some drivers that require mmapping /dev/mem with the PROT_EXEC flag (for example non-KSM video drivers, or drivers that need to execute BIOS / firmware code directly from /dev/mem).

However, it'd be nice to see if we still have drivers that are still relying on this dangerous behavior and provide some additional safety measures in the system.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1974442

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Launchpad Janitor (janitor)]

[Expired for linux (Ubuntu Kinetic) because there has been no activity for 60 days.]

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 5.19.0-15.15

---------------
linux (5.19.0-15.15) kinetic; urgency=medium

  * kinetic/linux: 5.19.0-15.15 -proposed tracker (LP: #1983335)

  * Miscellaneous Ubuntu changes
    - [Config] update annotations to support both gcc-11 and gcc-12

 -- Andrea Righi <email address hidden> Tue, 02 Aug 2022 09:23:01 +0200