From 9ab7dd216d46b2547ecc783719621cccc7144943 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Tue, 2 Aug 2022 16:01:40 +0000 Subject: [PATCH] mount: Fix mounting any file systems from the host system Signed-off-by: Michael Tremer --- src/libpakfire/mount.c | 48 +++++++++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/src/libpakfire/mount.c b/src/libpakfire/mount.c index bff245f97..5682b6c25 100644 --- a/src/libpakfire/mount.c +++ b/src/libpakfire/mount.c @@ -43,25 +43,43 @@ static const struct pakfire_mountpoint { int flags; const char* options; } mountpoints[] = { - { "pakfire_proc", "proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, }, - - // Bind mount /proc/sys as read-only with the following exceptions: - // * /proc/sys/net - { "/proc/sys", "proc/sys", "bind", MS_BIND, NULL, }, - { "/proc/sys/net", "proc/sys/net", "bind", MS_BIND, NULL, }, - { "/proc/sys", "proc/sys", "bind", MS_BIND|MS_RDONLY|MS_REMOUNT, NULL, }, - - // Bind mount /sys as read-only - { "/sys", "sys", "bind", MS_BIND, NULL, }, - { "/sys", "sys", "bind", MS_BIND|MS_RDONLY|MS_REMOUNT, NULL, }, + // Mount a new instance of /proc + { "pakfire_proc", "proc", "proc", + MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, }, + + // Make /proc/sys read-only (except /proc/sys/net) + { "/proc/sys", "proc/sys", "bind", MS_BIND|MS_REC, NULL, }, + { "/proc/sys/net", "proc/sys/net", "bind", MS_BIND|MS_REC, NULL, }, + { "/proc/sys", "proc/sys", "bind", + MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, }, + + // Deny write access to /proc/sysrq-trigger (can be used to restart the host) + { "/proc/sysrq-trigger", "proc/sysrq-trigger", "bind", MS_BIND|MS_REC, NULL, }, + { "/proc/sysrq-trigger", "proc/sysrq-trigger", "bind", + MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, }, + + // Make /proc/irq read-only + { "/proc/irq", "proc/irq", "bind", MS_BIND|MS_REC, NULL, }, + { "/proc/irq", "proc/irq", "bind", + MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, }, + + // Make /proc/bus read-only + { "/proc/bus", "proc/bus", "bind", MS_BIND|MS_REC, NULL, }, + { "/proc/bus", "proc/bus", "bind", + MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, }, + + // Bind-Mount /sys ready-only + { "/sys", "sys", "bind", MS_BIND|MS_REC, NULL, }, + { "/sys", "sys", "bind", + MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL, }, // Create a new /dev - { "pakfire_dev", "dev", "tmpfs", MS_NOSUID|MS_NOEXEC, - "mode=755,size=4m,nr_inodes=64k", }, - { "/dev/pts", "dev/pts", "bind", MS_BIND, NULL, }, + { "pakfire_dev", "dev", "tmpfs", MS_NOSUID|MS_NOEXEC, + "mode=0755,size=4m,nr_inodes=64k", }, + { "/dev/pts", "dev/pts", "bind", MS_BIND, NULL, }, // Create a new /run - { "pakfire_tmpfs", "run", "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, + { "pakfire_tmpfs", "run", "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=755,size=4m,nr_inodes=1k", }, // The end -- 2.47.2