0

I am working on an embedded Linux system (with kernel 5.10.24).
I am trying to disable sysfs from kernel, but I found some other stuffs relies on sysfs, so I have to enable sysfs in kernel build.

Now I want to hide file and directory under /sys, or disable the listing /sys/.
I changed the /etc/fstab for mounting /sys as follows,
sysfs /sys sysfs ro,noexec 0 0.

and ls -l / shows followings,
dr-xr-xr-x 13 root root 0 Jan 1 2020 sys

I can still get list with ls -l /sys.

So is there a way to mount sysfs as write-only (cannot list stuffs under /sys)?

Improve this question
14
  • Hi! That sounds a bit strange. What is the purpose of disallowing listing of sysfs? I'm pretty sure a write-only sysfs won't be very useful, either
    – Marcus Müller
    May 29, 2023 at 8:28
  • Marcus, I just want to ask how to make sysfs write-only, this is because, there are plenty of detailed info is exposed by sysfs, and for an embedded system, most of this info is redundent and not be used by application. So I would like to set sysfs as write-only.
    – wangt13
    May 29, 2023 at 9:04
  • That makes no sense – sysfs is part of your kernel API. Very little of that is redundant, and basically nothing related to system initialization would work without reading it. Which problem are you solving? Are you intending to sandbox some software? In that case, Linux namespaces (as used by containers) are probably the way to go.
    – Marcus Müller
    May 29, 2023 at 9:09
  • This is an embedded system, currently no password protected. So anyone can grab the system information for reverse-engineering if he can get the console, it is not secured. So I want to make sysfs write-only. Alternatively, I found in this embedded system, USB gadget is used, which relies on sysfs, if using USB gadget without relying on sysfs, sysfs can be totally dis-configured from kernel.
    – wangt13
    May 29, 2023 at 9:17
  • If anybody can get access, then write-only mounting sysfs solves exactly nothing? I honestly fail to see the real problem this addresses, or how it is even remotely a solution?
    – Marcus Müller
    May 29, 2023 at 9:18

1 Answer 1

Reset to default
1

I do not see an option to make sysfs content write-only with regular Linux tools.

If it would be enough to limit the sysfs content for certain processes then I see two options:

bind mounts

Create e.g. /sys-limited and mount --bind ... there everything those apps need from /sys. Then you put those processes into a separate mount namespace (can be the same for all) and in that you mount --bind /sys-limited /sys.

FUSE

Much more work (OK, that depends on how much change you need to /sys) but more flexible: You write your own FUSE module which, of course, can offer write-only access, too, or just show the entries you have whitelisted. Then you mount it at /sys-limited and do the namespace separation mentioned above.

Improve this answer
1
  • Thanks for your answer, to be frank, your answer is out of knowledge domain. And I am not sure if the resource is enough to do that in an customized embedded system. I would study more on stuff you mentioned and validate your answer once I get prepared. I would up your answer, but I don't know so far if it is right/correct for my original ask.
    – wangt13
    May 30, 2023 at 6:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .