Multiple filesystems for the paranoid

Fri, 16 Jan 2009 11:04:19 +0100
paranoia

Given the current discussion on planet.debian.org about having only one or multiple file-systems, I just wanted to add a plea for having multiple filesystems.

In my (perhaps a bit overly paranoid) eyes, having multiple filesystems is mainly a security measure. I prefer having enough partitions so that the following properties hold:

No unprivileged user has write access to a directory on the same filesystem as system programs are. Otherwise someone could just hardlink all suid programs and wait. There are high chances that some might have a security problem some day. Security and normal updates will install newer versions, fixing some bugs before enough people know it enough to exploit it or even before anyone at all knows they are there. To protect against this one, one could do scans for suid-root files in user-writable directories, or one just removes the possibility for this attack-vector.

No unprivileged user has write access anywhere that is not mounted nodev and nosuid. In theory that should make no difference, because the user cannot create anything evil anyway. But in practise there were enough exploits with core files and other stuff leading to an suid-root executable suddenly around.

No unprivileged user has write access anywhere that is not mounted nodev and nosuid. In theory that should make no difference, because the user cannot create anything evil anyway. But in practise there were enough exploits with core files and other stuff leading to an suid-root executable suddenly around. (And do not forget /proc, /sys, /lib/init/rw, /proc/bus/usb, ...).

If it is a server that interacts with untrusted users, there should be no place those daemons can write to that is not mounted noexec. While noexec is only a weak defense (scripts could still be executed by calling the interpreter with the script as argument), it gives a little bit more protection and has no real downsizes. The only noticeable one is that apt's preconfiguring of debconf using packages will not work but they will have to ask their questions when being configured. Again, it does not help much when not used consequently: Do not forget /var/tmp and all the little tmpfs the system adds somewhere.

Admittedly, those arguments may not be as convincing for a laptop as for a server. But I personally like to have paranoia enacted everywhere. Uniformness makes live much easier sometimes.

Update: If having paranoid in the title was not enough to hint you that I do not claim a system losing a significant amount of security compared to more important measures, let it be told to you know. It's all about thinking about even the little things and taking measures where they do not otherwise harm. To get the warm fuzzy feeling I got when e.g. CVE-2006-3626 was found and my computers had nosuid for /proc already set. ;->