Re: [PATCH v2 23/24] security: add filesystem security policies

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

On 17.09.25 15:53, Sascha Hauer wrote:
> We don't have any trusted filesystems in barebox and a manipulated
> filesystem could trick barebox into crashing or loading untrusted data,
> so add a security policy for the barebox filesystems.
> 
> With SCONFIG_FS_EXTERNAL set barebox will allow mounting all filesystems
> whereas with this option disabled only ramfs can be mounted. ramfs is
> special: It is basically essential for barebox and also has no untrusted
> data input.
> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  Sconfig    | 1 +
>  fs/Sconfig | 5 +++++
>  fs/fs.c    | 4 ++++
>  3 files changed, 10 insertions(+)
> 
> diff --git a/Sconfig b/Sconfig
> index 7d7657e79061f4bf200519cf1fab8810b544f97e..cdb2ceccb1b46b038c0d4fa8dbd203737031dec5 100644
> --- a/Sconfig
> +++ b/Sconfig
> @@ -8,3 +8,4 @@ source "security/Sconfig"
>  source "common/Sconfig"
>  source "drivers/usb/gadget/Sconfig"
>  source "commands/Sconfig"
> +source "fs/Sconfig"
> diff --git a/fs/Sconfig b/fs/Sconfig
> new file mode 100644
> index 0000000000000000000000000000000000000000..cdb58230f0e79addf8c0f719844af400e0d19939
> --- /dev/null
> +++ b/fs/Sconfig
> @@ -0,0 +1,5 @@
> +
> +config FS_EXTERNAL
> +	bool "Allow mounting external file systems"
> +	help
> +	  Say y to permit mounting file systems beyond devfs and ramfs.
> diff --git a/fs/fs.c b/fs/fs.c
> index 54bd35786857ab0e588277870fd1630d9292e116..5dcdf223756f470f94da15947e3f4e30bc27c1bd 100644
> --- a/fs/fs.c
> +++ b/fs/fs.c
> @@ -35,6 +35,7 @@
>  #include <libfile.h>
>  #include <parseopt.h>
>  #include <linux/namei.h>
> +#include <security/config.h>
>  
>  char *mkmodestr(unsigned long mode, char *str)
>  {
> @@ -774,6 +775,9 @@ static int fs_probe(struct device *dev)
>  	struct fs_driver *fsdrv = container_of(drv, struct fs_driver, drv);
>  	int ret;
>  
> +	if (!IS_ALLOWED(SCONFIG_FS_EXTERNAL) && strcmp(fsdrv->drv.name, "ramfs"))
> +		return -EPERM;

devfs is listed in the Kconfig help text, but missing here.

Cheers,
Ahmad

> +
>  	ret = dev->driver->probe(dev);
>  	if (ret)
>  		return ret;
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |