[PATCH v2 23/24] security: add filesystem security policies

[Sascha Hauer <s.hauer@pengutronix.de>]

We don't have any trusted filesystems in barebox and a manipulated
filesystem could trick barebox into crashing or loading untrusted data,
so add a security policy for the barebox filesystems.

With SCONFIG_FS_EXTERNAL set barebox will allow mounting all filesystems
whereas with this option disabled only ramfs can be mounted. ramfs is
special: It is basically essential for barebox and also has no untrusted
data input.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 Sconfig    | 1 +
 fs/Sconfig | 5 +++++
 fs/fs.c    | 4 ++++
 3 files changed, 10 insertions(+)

diff --git a/Sconfig b/Sconfig
index 7d7657e79061f4bf200519cf1fab8810b544f97e..cdb2ceccb1b46b038c0d4fa8dbd203737031dec5 100644
--- a/Sconfig
+++ b/Sconfig
@@ -8,3 +8,4 @@ source "security/Sconfig"
 source "common/Sconfig"
 source "drivers/usb/gadget/Sconfig"
 source "commands/Sconfig"
+source "fs/Sconfig"
diff --git a/fs/Sconfig b/fs/Sconfig
new file mode 100644
index 0000000000000000000000000000000000000000..cdb58230f0e79addf8c0f719844af400e0d19939
--- /dev/null
+++ b/fs/Sconfig
@@ -0,0 +1,5 @@
+
+config FS_EXTERNAL
+	bool "Allow mounting external file systems"
+	help
+	  Say y to permit mounting file systems beyond devfs and ramfs.
diff --git a/fs/fs.c b/fs/fs.c
index 54bd35786857ab0e588277870fd1630d9292e116..5dcdf223756f470f94da15947e3f4e30bc27c1bd 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -35,6 +35,7 @@
 #include <libfile.h>
 #include <parseopt.h>
 #include <linux/namei.h>
+#include <security/config.h>
 
 char *mkmodestr(unsigned long mode, char *str)
 {
@@ -774,6 +775,9 @@ static int fs_probe(struct device *dev)
 	struct fs_driver *fsdrv = container_of(drv, struct fs_driver, drv);
 	int ret;
 
+	if (!IS_ALLOWED(SCONFIG_FS_EXTERNAL) && strcmp(fsdrv->drv.name, "ramfs"))
+		return -EPERM;
+
 	ret = dev->driver->probe(dev);
 	if (ret)
 		return ret;

-- 
2.47.3