We don't have any trusted filesystems in barebox and a manipulated
filesystem could trick barebox into crashing or loading untrusted data,
so add a security policy for the barebox filesystems.
With SCONFIG_FS_EXTERNAL set barebox will allow mounting all filesystems
whereas with this option disabled only ramfs can be mounted. ramfs is
special: It is basically essential for barebox and also has no untrusted
data input.
Signed-off-by: Sascha Hauer <s.ha...@pengutronix.de>
---
Sconfig | 1 +
fs/Sconfig | 5 +++++
fs/fs.c | 4 ++++
3 files changed, 10 insertions(+)
diff --git a/Sconfig b/Sconfig
index
7d7657e79061f4bf200519cf1fab8810b544f97e..cdb2ceccb1b46b038c0d4fa8dbd203737031dec5
100644
--- a/Sconfig
+++ b/Sconfig
@@ -8,3 +8,4 @@ source "security/Sconfig"
source "common/Sconfig"
source "drivers/usb/gadget/Sconfig"
source "commands/Sconfig"
+source "fs/Sconfig"
diff --git a/fs/Sconfig b/fs/Sconfig
new file mode 100644
index
0000000000000000000000000000000000000000..cdb58230f0e79addf8c0f719844af400e0d19939
--- /dev/null
+++ b/fs/Sconfig
@@ -0,0 +1,5 @@
+
+config FS_EXTERNAL
+ bool "Allow mounting external file systems"
+ help
+ Say y to permit mounting file systems beyond devfs and ramfs.
diff --git a/fs/fs.c b/fs/fs.c
index
54bd35786857ab0e588277870fd1630d9292e116..5dcdf223756f470f94da15947e3f4e30bc27c1bd
100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -35,6 +35,7 @@
#include <libfile.h>
#include <parseopt.h>
#include <linux/namei.h>
+#include <security/config.h>
char *mkmodestr(unsigned long mode, char *str)
{
@@ -774,6 +775,9 @@ static int fs_probe(struct device *dev)
struct fs_driver *fsdrv = container_of(drv, struct fs_driver, drv);
int ret;
+ if (!IS_ALLOWED(SCONFIG_FS_EXTERNAL) && strcmp(fsdrv->drv.name,
"ramfs"))
+ return -EPERM;
+
ret = dev->driver->probe(dev);
if (ret)
return ret;
--
2.47.3
