Re: subvolumes as partitions and mount options

[Matt Zagrabelny <mzagrabe@d.umn.edu>]

On Mon, Mar 27, 2023 at 2:25 PM Andrei Borzenkov <arvidjaar@gmail.com> wrote:
>
> On 27.03.2023 21:48, Matt Zagrabelny wrote:
> > Greetings,
> >
> > I have a root partition btrfs file system.
> >
> > I need to have /tmp, /var, /var/tmp, /var/log, and other directories
> > under separate partitions so that certain mount options can be set for
> > those partitions/directories.
> >
> > I'm testing out a subvolume mount with the subvolume /subv_content
> > mounted at /subv_mnt.
> >
> > For instance, the noexec mount option can be circumvented:
>
> "exec/noexec" option applies to mount instance, it is not persistent
> property of underlying filesystem. It is not specific to btrfs at all.

Agreed. My email was more about subvolumes and the mount point has the
"noexec", but the actual subvolume doesn't - so there exists a path on
disk where folks can exec the same file by circumventing the mount
option by directly invoking the full path under the subvolume.

>
> bor@bor-Latitude-E5450:/tmp/tst$ ./bin/foo.sh
> Hello, world!
> bor@bor-Latitude-E5450:/tmp/tst$ mkdir exec noexec
> bor@bor-Latitude-E5450:/tmp/tst$ sudo mount -o bind,exec bin exec
> bor@bor-Latitude-E5450:/tmp/tst$ sudo mount -o bind,noexec bin noexec
> bor@bor-Latitude-E5450:/tmp/tst$ ./exec/foo.sh
> Hello, world!
> bash: ./noexec/foo.sh: Permission denied
> bor@bor-Latitude-E5450:/tmp/tst$

Agreed completely.

If an attacker can gain access to a system, I'd like /tmp to be
mounted "noexec".

The attacker can execute the foo.sh via /tmp/tst/bin/foo.sh even
though the bind mount (/tmp/tst/noexec) restricts the executing of
programs.

That seems to be the position I am in right now with subvolumes as
opposed to an actual partition.

If I create a separate partition for /tmp and mount it noexec, there
is no backdoor bind mount where the attacker can execute programs
from.

It seems mounting subvolumes works similarly to bind mounts - is there
a way to mimic /tmp being on a separate partition and mounted with
noexec using subvolumes?

Thanks for the help!

-m