4

I'm wondering about the effects of setting the nodev option for / mount in /etc/fstab.

As I understand it, nodev prevents the interpretation of special nodes, so you can prevent rogue users or attackers mounting and using their own device nodes to wreck havoc on the system.

My first thought was that mounting / with nodev would render /dev completely useless and prevent the system from starting up properly because no devices (including the partitions mounted on /home and /usr) could be used.

So, imagine my surprise when I tested it out on an Ubuntu installation and everything appeared to work as normal. /dev/zero and /dev/null did what they were supposed to. I didn't have other device nodes that I could do anything with, such as sockets, but not that I know what to do with them anyway.


  1. Can anyone explain what happened, and why the installation continued to work?

  2. Does the system implicity ignore stupid things like mounting / with nodev? For that matter, is the handling consistent across different distributions or kernels?

  3. And back to the original question: Are there actually (ill) effects that I did not manage to observe/trigger?

3 Answers 3

3

If you issue the mount command, (or cat /etc/mtab), you'll see that /dev is its own file system, separate from /:

...
udev on /dev type devtmpfs (rw,mode=0755)
...

On my drive, I don't seem to have any device files on my root file system. I looked for them with:

sudo find / -xdev -type b -o -type c

Mounting this file system with nodev would therefore have no noticeable effect.

3
  • Thank you for the insight on /dev and the suggestion to find non-standard files. I was able to test the setting on a Red Hat system, and while find did turn up named pipes and sockets on /, the system appeared to start up and work just fine.
    – aerobot
    Apr 2, 2016 at 17:22
  • So does this mean that what would be more problematic would be to rather set /dev as nodev?
    – The Quark
    May 24, 2019 at 12:10
  • 1
    Yup, that would wreak havoc, although I'm not sure how you would even do that, except with sudo mount -o remount,nodev /dev. But just for kicks, I tried that (in a VM in a live session), and ... well, bad things happened.
    – P Daddy
    May 24, 2019 at 17:33
0

after init mounts the root filesystem, but before the /dev/filesystem is mounted, the hidden /dev/ directory contained on the / filesystem, which has these files:

    crw-rw-rw- 1 root root 5, 1 Nov  9 20:27 console
    lrwxrwxrwx 1 root root   13 Nov  9 20:27 fd -> /proc/self/fd
    crw-rw-rw- 1 root root 1, 7 Nov  9 20:27 full
    crw-rw-rw- 1 root root 1, 3 Nov  9 20:27 null
    crw-rw-rw- 1 root root 5, 2 Nov  9 20:27 ptmx
    drwxr-xr-x 2 root root 4096 Nov  9 20:27 pts
    crw-rw-rw- 1 root root 1, 8 Nov  9 20:27 random
    drwxr-xr-x 2 root root 4096 Nov  9 20:27 shm
    lrwxrwxrwx 1 root root   15 Nov  9 20:27 stderr -> /proc/self/fd/2
    lrwxrwxrwx 1 root root   15 Nov  9 20:27 stdin -> /proc/self/fd/0
    lrwxrwxrwx 1 root root   15 Nov  9 20:27 stdout -> /proc/self/fd/1
    crw-rw-rw- 1 root root 5, 0 Nov  9 20:27 tty
    crw-rw-rw- 1 root root 1, 9 Nov  9 20:27 urandom
    crw-rw-rw- 1 root root 1, 5 Nov  9 20:27 zero

any attempt to write to these devices in that time frame would fail. this is a REALLY good question, because I don't know if any thing would actually do something. Your console may be screwed if something bad happens later. you might get some spam. Something may not have entropy.

1
  • Welcome to the site, and thank you for your contribution. Currently, your answer does not seem to address the question of what the nodev option does (or if it does, it is formulated such that at least I don't understand it). Perhaps you could try to reformulate your answer to make the explanation easier to access?
    – AdminBee
    Feb 26, 2021 at 8:23
-1

Well, I think you have a wrong view how those things work together. The installation continued to work, because the meaning of the nodev property is to send the message to not threat as a device any new created device on the managed partition.

The /dev directory discovers the devices based on the udev daemon. The rules how it will represent the devices in dev could be find in /lib/udev/rules.d as each file has a postfix with .rules.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .