From d20ea5595a892dd6c7e2f8da0b9927e70bccba3b Mon Sep 17 00:00:00 2001
From: Mattias Nissler <mnissler@chromium.org>
Date: Fri, 3 Jul 2020 12:10:05 +0200
Subject: [PATCH] Don't read udev rules from /run

Udev rules may contain command in RUN attributes. All runnable code in
Chrome OS must be subject to code verification, e.g. be located on the
verified root file system. /run isn't verified and mounted noexec, so
it's not appropriate to place code there. See also crbug.com/1072486.
---
 src/udev/udev-rules.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/src/udev/udev-rules.c
+++ b/src/udev/udev-rules.c
@@ -49,7 +49,9 @@ struct uid_gid {
 
 static const char* const rules_dirs[] = {
         "/etc/udev/rules.d",
-        "/run/udev/rules.d",
+        // Disabled on Chrome OS due to the policy that code and scripts must
+        // live on the verified root file system. See crbug.com/1072486
+        //"/run/udev/rules.d",
         UDEVLIBEXECDIR "/rules.d",
         NULL};
 
-- 
2.26.2