Shall we set 'devices=off' for the dataset of /usr/ports?

[Annalesa]

as title

 

[SirDice]

You could, there are no device nodes in the ports tree.

     devices=on|off
       Controls whether device nodes can be opened on this file system.  The
       default value is on.  The values on and off are equivalent to the dev
       and nodev mount options.

 

[mer]

You could, there are no device nodes in the ports tree.

Or there should be no device nodes.
I think in the past being able to create device nodes "everywhere" was considered a potential security risk. So user being able to create device nodes in their home dir was a possible path to privilege escalation.

I don't know if that still holds true.
I think by default "/dev" is ephemeral, like a memory back filesystem, so perhaps on ZFS the default should be off.

The question for me is "what does ...device nodes can be opened..." mean? An application running on a filesystem trying to open /dev/blah? or is it really "/filesystem/dev/blah"?

I don't know the answer, just asking questions.

 

[SirDice]

so perhaps on ZFS the default should be off.

It's on by default if you mount UFS, XFS, Ext2/3/4, btrfs, basically any filesystem that supports device nodes (FAT for example doesn't). It's up to the admin of the box to determine how far those security restrictions need to be applied. Same applies to noexec and nosuid.

The question for me is "what does ...device nodes can be opened..." mean? An application running on a filesystem trying to open /dev/blah? or is it really "/filesystem/dev/blah"?

The last. It prevents creation (and access) of device nodes on that specific filesystem. Much like nosuid will prevent the creation and usage of SUID files within that filesystem.

 

[covacat]

does not seem to have any effect, i can mknod with it on or off
anyway nodes created do not have any effect probably since devfs.

so this one seems to have no effect but in general making non std changes will break things sometimes
for example running /tmp with noexec will break make installworld

 

[Alain De Vos]

I wonder , as question what is poudriere doing ?

 

[SirDice]

I wonder , as question what is poudriere doing ?

Not quite understanding the relation here? With that ports tree you mean? Absolutely nothing besides creating/deleting/updating it with poudriere-ports(8).

 

[Alain De Vos]

yeah, if i'm correct poudriere only creates jails and mount zfs or so.

 

[SirDice]

yeah, if i'm correct poudriere only creates jails and mount zfs or so.

The build jobs will get a ports tree and some other bits and pieces mounted through nullfs(4) or tmpfs(4) (depends on your USE_TMPFS setting). The ports tree it needs is actually mounted read-only in that build jail.

For example (there's a build currently running):

/usr/local/poudriere/ports/desktop on /usr/local/poudriere/data/.m/15-stable-desktop/08/usr/ports (nullfs, local, read-only)