mount /proc at boot as read-only
Hello all, I am trying to harden the embedded system. Is it possible and safe to mount /proc file system in a read-only mode and how to do this? I have embedded system with systemd where /proc is mounted rw. I suspect that systemd mounts it when it bebgns to bootsrtap user space. On my currently idle and small embedded board and on QEMU I was able to remount /proc read-only. But when I changed fstab to mount it as a read-only it is still mounted rw,relatime after reboot. So who mounts it first ? Is it hardcoded in systemd when it starts process of PID 1 or in a kernel? Regards, Lev
On Sun, 06 Jan 2019 21:13:26 +0300, Lev Olshvang said:
I am trying to harden the embedded system. I have embedded system with systemd .....
OK, you've already got a problem right there. It's an embedded system. Therefor, you know everything that should be running, and what order it should start in. If you don't already know that, you have bigger design issues. So you probably want to reduce system complexity and save both RAM and flash memory space by heaving systemd over the side and using something simpler (sysvinit, or upstart, or even use '/bin/make' if you want to guarantee that certain tasks don't start till others have actually launched successfully, or use a custom-written system launcher). That's going to do more to reduce the attack surface than any amount of monkeying around with the permissions in /proc will do.
On Sun, Jan 06, 2019 at 09:13:26PM +0300, Lev Olshvang wrote:
Hello all,
I am trying to harden the embedded system.
Please define exactly what you mean by "harden".
Is it possible and safe to mount /proc file system in a read-only mode and how to do this?
Why would you want /proc to be read-only? What is that going to protect you from? What is insecure in there as-is?
I have embedded system with systemd where /proc is mounted rw.
Odds are your system needs this that way. If not, then why mount proc at all? Why not just disable the proc filesystem from your kernel entirely and not even worry about it at all? thanks, greg k-h
participants (3)
-
Greg KH -
Lev Olshvang -
valdis.kletnieks＠vt.edu