| # Force-enable -c/--no-canonicalize for mount(8). |
| # This will prevent mount(8) from following symlinks, which can be used |
| # essentially as a write-anywhere-as-root primitive. |
| # See b/194944898 for details. |
| |
| --- a/sys-utils/mount.c 2021-02-12 06:32:01.835988410 -0500 |
| +++ b/sys-utils/mount.c 2022-03-18 18:53:36.704541168 -0400 |
| @@ -862,6 +862,10 @@ |
| mnt_context_set_optsmode(cxt, optmode); |
| } |
| |
| + /* Always disable canonicalization to avoid following malicious |
| + symlinks. */ |
| + mnt_context_disable_canonicalize(cxt, TRUE); |
| + |
| if (fstab && !mnt_context_is_nocanonicalize(cxt)) { |
| /* |
| * We have external (context independent) fstab instance, let's |
