3346b4afc
Denys Vlasenko
2017-08-04
Subject
modutils: make them NOEXEC except depmod
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
NOFORK_NOEXEC.lst +5 -5modutils/insmod.c +1 -1modutils/lsmod.c +1 -1modutils/modinfo.c +1 -1modutils/modprobe-small.c +9 -6modutils/modprobe.c +1 -1modutils/rmmod.c +1 -1
NOFORK_NOEXEC.lst+5 -5
| @@ -156,7 +156,7 @@ ifplugd - daemon | |
| inetd - daemon | |
| init - daemon | |
| inotifyd - daemon | |
| - | insmod |
| + | insmod - noexec |
| install - runner | |
| ionice - spawner | |
| iostat - runner | |
| @@ -193,7 +193,7 @@ lpq - runner | |
| lpr - runner | |
| ls - noexec. runner | |
| lsattr | |
| - | lsmod |
| + | lsmod - noexec |
| lsof - complex | |
| lspci | |
| lsscsi | |
| @@ -220,8 +220,8 @@ mknod - noexec | |
| mkpasswd | |
| mkswap | |
| mktemp | |
| - | modinfo |
| - | modprobe |
| + | modinfo - noexec |
| + | modprobe - noexec |
| more - interactive | |
| mount - suid | |
| mountpoint | |
| @@ -277,7 +277,7 @@ resize - noexec. changes state (signal handlers) | |
| rev - runner | |
| rm - noexec. rm -i interactive | |
| rmdir - NOFORK | |
| - | rmmod |
| + | rmmod - noexec |
| route | |
| rpm - runner | |
| rpm2cpio - runner | |
modutils/insmod.c+1 -1
| @@ -13,7 +13,7 @@ | |
| //config: help | |
| //config: insmod is used to load specified modules in the running kernel. | |
| - | //applet:IF_INSMOD(IF_NOT_MODPROBE_SMALL(APPLET(insmod, BB_DIR_SBIN, BB_SUID_DROP))) |
| + | //applet:IF_INSMOD(IF_NOT_MODPROBE_SMALL(APPLET_NOEXEC(insmod, insmod, BB_DIR_SBIN, BB_SUID_DROP, insmod))) |
| //kbuild:ifneq ($(CONFIG_MODPROBE_SMALL),y) | |
| //kbuild:lib-$(CONFIG_INSMOD) += insmod.o modutils.o | |
modutils/lsmod.c+1 -1
| @@ -23,7 +23,7 @@ | |
| //config: the format of module-init-tools for Linux kernel 2.6. | |
| //config: Increases size somewhat. | |
| - | //applet:IF_LSMOD(IF_NOT_MODPROBE_SMALL(APPLET(lsmod, BB_DIR_SBIN, BB_SUID_DROP))) |
| + | //applet:IF_LSMOD(IF_NOT_MODPROBE_SMALL(APPLET_NOEXEC(lsmod, lsmod, BB_DIR_SBIN, BB_SUID_DROP, lsmod))) |
| //kbuild:ifneq ($(CONFIG_MODPROBE_SMALL),y) | |
| //kbuild:lib-$(CONFIG_LSMOD) += lsmod.o modutils.o | |
modutils/modinfo.c+1 -1
| @@ -12,7 +12,7 @@ | |
| //config: help | |
| //config: Show information about a Linux Kernel module | |
| - | //applet:IF_MODINFO(APPLET(modinfo, BB_DIR_SBIN, BB_SUID_DROP)) |
| + | //applet:IF_MODINFO(APPLET_NOEXEC(modinfo, modinfo, BB_DIR_SBIN, BB_SUID_DROP, modinfo)) |
| //kbuild:lib-$(CONFIG_MODINFO) += modinfo.o modutils.o | |
modutils/modprobe-small.c+9 -6
| @@ -11,12 +11,15 @@ | |
| /* modprobe-small configs are defined in Config.src to ensure better | |
| * "make config" order */ | |
| - | //applet:IF_LSMOD( IF_MODPROBE_SMALL(APPLET(lsmod, BB_DIR_SBIN, BB_SUID_DROP))) |
| - | //applet:IF_MODPROBE(IF_MODPROBE_SMALL(APPLET(modprobe, BB_DIR_SBIN, BB_SUID_DROP))) |
| - | // APPLET_ODDNAME:name main location suid_type help |
| - | //applet:IF_DEPMOD(IF_MODPROBE_SMALL(APPLET_ODDNAME(depmod, modprobe, BB_DIR_SBIN, BB_SUID_DROP, depmod))) |
| - | //applet:IF_INSMOD(IF_MODPROBE_SMALL(APPLET_ODDNAME(insmod, modprobe, BB_DIR_SBIN, BB_SUID_DROP, insmod))) |
| - | //applet:IF_RMMOD( IF_MODPROBE_SMALL(APPLET_ODDNAME(rmmod, modprobe, BB_DIR_SBIN, BB_SUID_DROP, rmmod))) |
| + | //applet:IF_LSMOD( IF_MODPROBE_SMALL(APPLET_NOEXEC( lsmod, lsmod, BB_DIR_SBIN, BB_SUID_DROP, lsmod ))) |
| + | //applet:IF_MODPROBE(IF_MODPROBE_SMALL(APPLET_NOEXEC( modprobe, modprobe, BB_DIR_SBIN, BB_SUID_DROP, modprobe))) |
| + | // APPLET_ODDNAME:name main location suid_type help |
| + | //applet:IF_DEPMOD( IF_MODPROBE_SMALL(APPLET_ODDNAME(depmod, modprobe, BB_DIR_SBIN, BB_SUID_DROP, depmod ))) |
| + | //applet:IF_INSMOD( IF_MODPROBE_SMALL(APPLET_NOEXEC( insmod, modprobe, BB_DIR_SBIN, BB_SUID_DROP, insmod ))) |
| + | //applet:IF_RMMOD( IF_MODPROBE_SMALL(APPLET_NOEXEC( rmmod, modprobe, BB_DIR_SBIN, BB_SUID_DROP, rmmod ))) |
| + | /* noexec speeds up boot with many modules loaded (need SH_STANDALONE=y) */ |
| + | /* I measured about ~5 times faster insmod */ |
| + | /* depmod is not noexec, it runs longer and benefits from memory trimming via exec */ |
| //kbuild:lib-$(CONFIG_MODPROBE_SMALL) += modprobe-small.o | |
modutils/modprobe.c+1 -1
| @@ -26,7 +26,7 @@ | |
| //config: hardware autodetection scripts to load modules like evdev, frame | |
| //config: buffer drivers etc. | |
| - | //applet:IF_MODPROBE(IF_NOT_MODPROBE_SMALL(APPLET(modprobe, BB_DIR_SBIN, BB_SUID_DROP))) |
| + | //applet:IF_MODPROBE(IF_NOT_MODPROBE_SMALL(APPLET_NOEXEC(modprobe, modprobe, BB_DIR_SBIN, BB_SUID_DROP, modprobe))) |
| //kbuild:ifneq ($(CONFIG_MODPROBE_SMALL),y) | |
| //kbuild:lib-$(CONFIG_MODPROBE) += modprobe.o modutils.o | |
modutils/rmmod.c+1 -1
| @@ -14,7 +14,7 @@ | |
| //config: help | |
| //config: rmmod is used to unload specified modules from the kernel. | |
| - | //applet:IF_RMMOD(IF_NOT_MODPROBE_SMALL(APPLET(rmmod, BB_DIR_SBIN, BB_SUID_DROP))) |
| + | //applet:IF_RMMOD(IF_NOT_MODPROBE_SMALL(APPLET_NOEXEC(rmmod, rmmod, BB_DIR_SBIN, BB_SUID_DROP, rmmod))) |
| //kbuild:ifneq ($(CONFIG_MODPROBE_SMALL),y) | |
| //kbuild:lib-$(CONFIG_RMMOD) += rmmod.o modutils.o | |