From: Daan De Meyer <daan.j.demeyer@gmail.com>
Date: Fri, 21 Feb 2025 09:57:39 +0000 (+0100)
Subject: Reduce the number of filesystems we remount noexec/nosuid/nodev when root
X-Git-Tag: v26~358
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bae79ab18949b60c6c09461c1fc725109ab852c6;p=thirdparty%2Fmkosi.git

Reduce the number of filesystems we remount noexec/nosuid/nodev when root

For mkosi-initrd, /etc might very well contain executable scripts which
we should allow to run, so let's only mount /boot and /efi nodev/nosuid/noexec.
---

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index 9c52fcc25..b8abba045 100644
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -4894,7 +4894,7 @@ def run_build(
                 continue
 
             attrs = MOUNT_ATTR_RDONLY
-            if d not in ("/usr", "/opt"):
+            if d in ("/boot", "/efi"):
                 attrs |= MOUNT_ATTR_NOSUID | MOUNT_ATTR_NODEV | MOUNT_ATTR_NOEXEC
 
             mount_rbind(d, d, attrs)