From c92f710524a370d8e910b74d7ba062373d02d7a6 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Tue, 19 Jul 2022 09:38:40 +0000 Subject: [PATCH] mount: Adjust mount flags for unprivileged users Bind-mounts require us to set MS_REC and remounting any mountpoint requires us to now downgrade on noexec/nodev/nosuid. Signed-off-by: Michael Tremer --- src/libpakfire/mount.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/libpakfire/mount.c b/src/libpakfire/mount.c index e671a6955..cd33a1f31 100644 --- a/src/libpakfire/mount.c +++ b/src/libpakfire/mount.c @@ -43,25 +43,27 @@ static const struct pakfire_mountpoint { int flags; const char* options; } mountpoints[] = { - { "pakfire_proc", "proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, }, + { "pakfire_proc", "proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, }, // Bind mount /proc/sys as read-only with the following exceptions: // * /proc/sys/net - { "/proc/sys", "proc/sys", "bind", MS_BIND, NULL, }, - { "/proc/sys/net", "proc/sys/net", "bind", MS_BIND, NULL, }, - { "/proc/sys", "proc/sys", "bind", MS_BIND|MS_RDONLY|MS_REMOUNT, NULL, }, + { "/proc/sys", "proc/sys", "bind", MS_BIND|MS_REC, NULL, }, + { "/proc/sys/net", "proc/sys/net", "bind", MS_BIND|MS_REC, NULL, }, + { "/proc/sys", "proc/sys", "bind", + MS_BIND|MS_RDONLY|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, }, // Bind mount /sys as read-only - { "/sys", "sys", "bind", MS_BIND, NULL, }, - { "/sys", "sys", "bind", MS_BIND|MS_RDONLY|MS_REMOUNT, NULL, }, + { "/sys", "sys", "bind", MS_BIND|MS_REC, NULL, }, + { "/sys", "sys", "bind", + MS_BIND|MS_RDONLY|MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, }, // Create a new /dev - { "pakfire_dev", "dev", "tmpfs", MS_NOSUID|MS_NOEXEC, + { "pakfire_dev", "dev", "tmpfs", MS_NOSUID|MS_NOEXEC, "mode=755,size=4m,nr_inodes=64k", }, - { "/dev/pts", "dev/pts", "bind", MS_BIND, NULL, }, + { "/dev/pts", "dev/pts", "bind", MS_BIND|MS_REC, NULL, }, // Create a new /run - { "pakfire_tmpfs", "run", "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, + { "pakfire_tmpfs", "run", "tmpfs", MS_NOSUID|MS_NOEXEC|MS_NODEV, "mode=755,size=4m,nr_inodes=1k", }, // The end -- 2.39.5