1

Environment

Distro: CentOS7 Kernel: 3.10.0-427.10.1.lve1.4.7.el7.x86_64.

Scenario

This is a shared hosting environment and I just noticed that only /dev/mqueue and /dev/shm have 1777 permissions (/tmp and /var/tmp also but they are besides the point here).

Questions

  1. Does that pose a threat to the security of the server? For instance, a system user might occupy the directories with useless junk and fill their disk quota;
  2. Given that the entire /dev directory is mounted on devtmpfs, does that mean that everything will be flushed/deleted from the directory once a reboot takes place?
  3. What is the difference between tmpfs and devtmpfs?

Here's what's currently mounted:

Filesystem      Size  Used Avail Use% Mounted on
/dev/sdi1       148G  730M  140G   1% /
devtmpfs         59G     0   59G   0% /dev
tmpfs            59G     0   59G   0% /dev/shm
tmpfs            59G  4.1G   55G   7% /run
tmpfs            59G     0   59G   0% /sys/fs/cgroup
/dev/sdh1       148G   14G  127G  10% /usr
/dev/sda1       2.0G  269M  1.6G  15% /boot
/dev/sdg1       148G  7.7G  133G   6% /var
/dev/sdd1       148G  468M  140G   1% /tmp
/dev/sdc1       493G   13G  455G   3% /ssd
/dev/sde1       493G   37G  431G   8% /localbkp
/dev/sdf1       8.0T  515G  7.1T   7% /home
tmpfs            12G     0   12G   0% /run/user/0
tmpfs            12G     0   12G   0% /run/user/1242
tmpfs            12G     0   12G   0% /run/user/1507
tmpfs            12G     0   12G   0% /run/user/1812

Thank you.

1

Does that pose a threat to the security of the server? For instance, a system user might occupy the directories with useless junk and fill their disk quota;

Sure, but they can already just fill up memory by malloc()ing too much anyway (Yes, you can use ulimit(), but that's a per process limit). If you want to protect users from each other's memory usage, you'll have to put them in different containers.

Given that the entire /dev directory is mounted on devtmpfs, does that mean that everything will be flushed/deleted from the directory once a reboot takes place?

Yes.

What is the difference between tmpfs and devtmpfs?

From the kernel's CONFIG_DEVTMPFS documentation:

This creates a tmpfs filesystem, and mounts it at bootup and mounts it at /dev. The kernel driver core creates device nodes for all registered devices in that filesystem. All device nodes are owned by root and have the default mode of 0600. Userspace can add and delete the nodes as needed. This is intended to simplify bootup, and make it possible to delay the initial coldplug at bootup done by udev in userspace. It should also provide a simpler way for rescue systems to bring up a kernel with dynamic major/minor numbers. Meaningful symlinks, permissions and device ownership must still be handled by userspace.

  • Right, so is it actually a security threat to have /dev/shm and /dev/mqueue world-writable with a sticky bit? – McJohnson Oct 30 '16 at 19:09
  • As I said, not much more or a security threat than malloc() – Celada Oct 30 '16 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.