ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sdcard: mount sdcard with the noexec option

Browse source 
Vold mounts the sdcard with noexec, but the fuse deamon
mounts with exec, so it is still possible to execute
binaries:

  /dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,relatime,
  user_id=1023,group_id=1023,default_permissions,allow_other 0 0

  /dev/block/vold/179:65 /mnt/media_rw/sdcard1 vfat rw,dirsync,
  nosuid,nodev,noexec,relatime,uid=1023,gid=1023,fmask=0007,
  dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,
  shortname=mixed,utf8,errors=remount-ro 0 0

With this change both vold and fuse mounts with noexec.

(cherry picked from commit f777d6694eecf6e61d9859df2090199863050017)

Change-Id: I66cbfc3a3a89a26958f83577f5e7a5e27f99184e
This commit is contained in:
Daisuke Okitsu 2014-11-24 09:37:55 +01:00 • committed by Jeff Sharkey
parent 83d85563c5
commit a5a4e9e0ca
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sdcard/sdcard.c
View file

@ -1807,7 +1807,7 @@ static int run(const char* source_path, const char* dest_path, uid_t uid,
"fd=%i,rootmode=40000,default_permissions,allow_other,user_id=%d,group_id=%d",
fd, uid, gid);
res = mount("/dev/fuse", dest_path, "fuse", MS_NOSUID | MS_NODEV, opts);
res = mount("/dev/fuse", dest_path, "fuse", MS_NOSUID | MS_NODEV | MS_NOEXEC, opts);
if (res < 0) {
ERROR("cannot mount fuse filesystem: %s\n", strerror(errno));
goto error;