Secure Bind Mount & Protect Hardware

[monsieuremre]

Hello. This pull request resolves two currently open issues. One is protecting hardware by limiting access to /proc and /sys. Well good news. I present you the best way possible. Mounting proc with subset=pid ensure that only the pid subset under proc is visible, everything else is invisible. This is also the case for root. No one can see anything. /proc/dma, /proc/iomem, /proc/ioports, /proc/meminfo, /proc/kallsyms, /proc/kcore and literally tons of other stuff, everything protected even from root. Just ls /proc to see for yourself what gets hidden.

When it comes to /sys, starting based on this comment, I found the sources of breakages. The comment is true, but not complete, because there are also other subsets that break too, apart from just fs. Those are enabled, and everything else is disabled. Tested.

And bind mounting. You said not having bind mounts is a big deal. You said binds are important, they are our lives. Well. You say no more. I give you binds, a lot of them, and them only. At this point, we might as well just bind everything, disregarding if it has a proper real partition. Because even if it does have a partition, bind mounting to itself does no harm literally. The overhead seems to be really really minimal and unnoticable. So this is the current suggestion. Test for yourself and report please.

[adrelanos]

Thank you, there's some really nice research here!

I am afraid, we are going in cycles here. Some stuff disregarded here...

If a systemd unit file based implementation, then there's already a better systemd unit file here:
https://github.com/Kicksecure/security-misc/blob/master/usr/lib/systemd/system/remount-secure.service

related:
https://www.kicksecure.com/wiki/Dev/remount-secure#systemd_unit_file_based_mount_options_hardening

The existing script remount-secure seems also better:
https://github.com/Kicksecure/security-misc/blob/master/usr/bin/remount-secure

• configureable
• error handling
• log output

I would prefer to improve that instead.

• Any wrong / missing mount options (if any).
• --make-private (which seems interesting)

Secure mount options should not be mixed with:

• improve hide-hardware-info.service, make /sys hiding optional #172

I am not sure this can be merged. But just leave it open. There are really good suggestions here.

[adrelanos]

Type noosuid here but nvm.

[adrelanos]

Adding more folders to remount-secure now...

[adrelanos]

Done.

[adrelanos]

Changes suggested here:

• remount related: made it into remount-secure script and systemd unit.
• into the related issue improve hide-hardware-info.service, make /sys hiding optional #172