tree 95c15347cb950a58dd52c1b26300175f69ff1119
parent 0df2bb39614c758c8abf3d4d6de6f81be74c8314
author Ryan Borzello <rborzello@google.com> 1658513671 +0000
committer Chromeos LUCI <chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com> 1659126515 +0000

upstart: Apply nosymfollow to /tmp

Symlinks can be used in the /tmp folder to trick crash_reporter into
deleting arbitrary files.

Mount the /tmp folder with nosymfollow flag to prevent an attacker with
write access to /tmp from confusing and redirecting code that uses
/tmp.

BUG=b:235148382
TEST=verify that /tmp remounted with nosymfollow

Cq-Depend: chromium:3785359
Change-Id: I031fed6c6917228a2141da3fce7f5bc44b8ad670
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/upstart/+/3783196
Reviewed-by: Jason Ling <jasonling@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Commit-Queue: Ryan Borzello <rborzello@chromium.org>
Reviewed-by: Sarthak Kukreti <sarthakkukreti@chromium.org>
Tested-by: Ryan Borzello <rborzello@chromium.org>
Owners-Override: Andres Calderon Jaramillo <andrescj@google.com>