Bug#1041552: HFS/HFS+ are insecure

From	Marco d'Itri <md@Linux.IT>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1041552: HFS/HFS+ are insecure
Date	2023-08-27 02:40 +0200
Message-ID	<H7bYR-4DEw-5@gated-at.bofh.it> (permalink)
References	(6 earlier) <GTG6t-1z5m-19@gated-at.bofh.it> <GTG6t-1z5m-21@gated-at.bofh.it> <GTG6t-1z5m-23@gated-at.bofh.it> <GTG6t-1z5m-31@gated-at.bofh.it> <GTG6t-1z5m-31@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Control: reassign -1 udisks2
Control: retitle -1 do not mount automatically unmaintained file systems

On Jul 20, md wrote:

> You are totally correct.
> Kernel team, please blacklist HFS/HFS+ for automounting.
As discussed on debian-devel@, this policy should not be handled by the 
kernel because modules autoloading of file systems drivers should not be
disabled.

So I propose this content for a file like
/usr/lib/udev/rules.d/75-insecure-fs.rules:

# Do not automatically mount these file systems because their drivers are
# marked as "orphan" or "odd fixes" in the kernel MAINTAINERS file and so
# are more at risk of having security-sensitive defects which could be
# exploited by a crafted file system.
SUBSYSTEM!="block", GOTO="udisks_insecure_fs_end"

ENV{ID_FS_TYPE}=="affs", ENV{UDISKS_AUTO}="0"
ENV{ID_FS_TYPE}=="ecryptfs", ENV{UDISKS_AUTO}="0"
ENV{ID_FS_TYPE}=="efs", ENV{UDISKS_AUTO}="0"
ENV{ID_FS_TYPE}=="hfs", ENV{UDISKS_AUTO}="0"
ENV{ID_FS_TYPE}=="hfsplus", ENV{UDISKS_AUTO}="0"
ENV{ID_FS_TYPE}=="jffs2", ENV{UDISKS_AUTO}="0"
ENV{ID_FS_TYPE}=="jfs", ENV{UDISKS_AUTO}="0"
ENV{ID_FS_TYPE}=="qnx6", ENV{UDISKS_AUTO}="0"
ENV{ID_FS_TYPE}=="sysv", ENV{UDISKS_AUTO}="0"

LABEL="udisks_insecure_fs_end"

-- 
ciao,
Marco

Back to linux.debian.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1041552: HFS/HFS+ are insecure Marco d'Itri <md@Linux.IT> - 2023-07-20 20:10 +0200
  Re: HFS/HFS+ are insecure Marco d'Itri <md@Linux.IT> - 2023-07-21 11:00 +0200
    Re: HFS/HFS+ are insecure Magissia <debianlist@magissia.com> - 2023-07-21 11:10 +0200
    Re: HFS/HFS+ are insecure Martin Steigerwald <martin@lichtvoll.de> - 2023-07-21 12:10 +0200
    Re: HFS/HFS+ are insecure Bastien Roucariès <rouca@debian.org> - 2023-07-21 13:00 +0200
      Re: HFS/HFS+ are insecure Bastien Roucariès <rouca@debian.org> - 2023-07-21 13:10 +0200
    Re: HFS/HFS+ are insecure Matthew Garrett <mjg59@srcf.ucam.org> - 2023-07-21 19:40 +0200
      Re: HFS/HFS+ are insecure Ben Hutchings <ben@decadent.org.uk> - 2023-07-23 02:40 +0200
  Processed: Re: HFS/HFS+ are insecure "Debian Bug Tracking System" <owner@bugs.debian.org> - 2023-08-27 02:40 +0200
  Bug#1041552: HFS/HFS+ are insecure Marco d'Itri <md@Linux.IT> - 2023-08-27 02:40 +0200

csiph-web