0

I'm studying device files and I've seen some mount points cannot accept the device file creation (if nodev option is set). Considering my mount output:

sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
.....
debugfs on /sys/kernel/debug type debugfs (rw,relatime)

I've tried to create a device file in /sys/kernel/debug (the directory has been chosen only because it doesn't have the nodev option) but the operation is not permitted. I don't understand the rationale behind it: why is the operation not possible?

0

You can’t write to /sys/kernel/debug because it’s not a general-purpose file system; it’s the kernel’s debugfs, which exists to allow the kernel to export debug information to user space.

The differences in mount options are caused by whatever mounted the file systems. In your case, I’m guessing they were mounted by systemd. The “core” file systems (/sys, /proc, /dev etc.) are mounted early on in src/core/mount-setup.c (see mount_table for details), with nodev etc. /sys/kernel/debug is mounted by a separate unit, sys-kernel-debug.mount , which doesn’t specify any mount options. I’m not sure there’s any particular rationale behind the difference in mount options.

As to why nodev is important, see Why is "nodev" in /etc/fstab so important? How can character devices be used for hacking?

  • About debugfs: you're right...it is a special filesystem but I don't understand why the nodev is not present (as proc filesystem or other special filesystems). – andrew Oct 27 '18 at 17:58
  • You second link is very interesting and I've tried to re-create the trick described without any result. For example, creating a device driver in /home with mknod -m 666 usermem c 1, 1 and changing to another user I obtain "operation not permitted". I'm not really sure, but I think this is due to the absence of CAP_SYS_RAWIO. Am I right? Do you know some related "attacks"?Any link? – andrew Oct 27 '18 at 18:11
  • You’re right, the /dev/mem attack is flawed, I’ll revisit that answer tomorrow or Monday. – Stephen Kitt Oct 27 '18 at 18:48
  • About debugfs: thanks for your answer...now it's more clear. But how can I know which filesystems support device file creation (and hence the nodev option shall be used in order to avoid mknod) and which ones not? Do you know any useful link? – andrew Oct 27 '18 at 19:10
  • Thanks again for the second link: I'll wait your modifications – andrew Oct 27 '18 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.