init: Mount /dev without the noexec option

This partially reverts commit eb98d2ea110b "init: /dev can be noexec
and /run nodev".  The noexec option broke v86d (which we have a
specific workaround for), and could also be a problem for SGX support
in future.

Using noexec here doesn't provide a security benefit in a default
Debian configuration, since there are other writable directories on
filesystems not mounted with this option.  Those are also writable by
all users, not just uid 0.

The mount options can be overridden by an entry for /dev in /etc/fstab
(at least when booting with systemd).

References: https://lore.kernel.org/linux-sgx/20201209000321.GA62845@kernel.org/T/
Signed-off-by: Ben Hutchings <benh@debian.org>

1 files changed, 1 insertions, 2 deletions

diff --git a/init b/init
index 3ad5579..0eaee1c 100755
--- a/init
+++ b/init
@@ -33,8 +33,7 @@ export quiet
 
 # Note that this only becomes /dev on the real filesystem if udev's scripts
 # are used; which they will be, but it's worth pointing out
-test -x /usr/sbin/v86d && dev_exec="exec" || dev_exec="noexec"
-mount -t devtmpfs -o $dev_exec,nosuid,mode=0755 udev /dev
+mount -t devtmpfs -o nosuid,mode=0755 udev /dev
 mkdir /dev/pts
 mount -t devpts -o noexec,nosuid,gid=5,mode=0620 devpts /dev/pts || true