Sample Header Ad - 728x90

Unable to mount from a script using shebang (kernel hardening related ?)

0 votes
0 answers
68 views
I stumbled across a really weird issue with mount. I'm unable to make sense out of it. For some context, I wrote a Python script that aims to automount hot-pluggable USB devices, but this is not relevant. Here's the mount error that occurs:
mount: /media/usb/backup: filesystem was mounted, but any subsequent operation failed: Operation not permitted.
I have a LUKS partition already unlocked and I'm trying to mount it using my script.
$ lsblk /dev/sdb
NAME                                     MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
sdb                                        8:16   0  1.8T  0 disk
├─sdb1                                     8:17   0   64M  0 part
├─sdb2                                     8:18   0  128M  0 part
├─sdb3                                     8:19   0   10G  0 part
└─sdb4                                     8:20   0  1.8T  0 part
  └─cfe1c7ab-36cc-4419-9373-764aaae1033f 254:1    0  1.8T  0 crypt
I created a minimal reproducible example which is as follow:
#!/usr/bin/bash
mount /dev/mapper/cfe1c7ab-36cc-4419-9373-764aaae1033f
The x bit is set and when I run this script using the shebang, I get the same error as above:
$ sudo /tmp/test
mount: /media/usb/backup: filesystem was mounted, but any subsequent operation failed: Operation not permitted.
The weird thing is that if I run this exact same command in my shell, it does work:
$ sudo mount /dev/mapper/cfe1c7ab-36cc-4419-9373-764aaae1033f
$ echo $?
0
When I run my script not using the shebang but by using the bash explicitly, it works as well:
$ sudo bash /tmp/test
$ echo $?
0
So apparently there's something happening with the shebang which triggers the Operation not permitted error. If I'm not mistaken the shebang is handled directly by the kernel, therefore I'm starting to wonder if it has anything to do with the fact I'm using ArchLinux's [linux-hardened](https://github.com/anthraxx/linux-hardened) (which is a fork of GraphenOS kernel). Are you aware of any Linux mechanism (mount namespace?) that could trigger that error when running a script with a shebang ? Thanks for reading me.
Asked by ShellCode (235 rep)
Sep 3, 2023, 12:17 AM