From 4a9e03aa6bb2cbd23dac00f2b2a7642cc79eaade Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Wed, 27 Sep 2023 11:55:59 +0200 Subject: [PATCH] core: Make private /dev read-only after populating it --- src/core/namespace.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/core/namespace.c b/src/core/namespace.c index e2304f5d066..d1153f76901 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -995,6 +995,11 @@ static int mount_private_dev(MountEntry *m) { if (r < 0) log_debug_errno(r, "Failed to set up basic device tree at '%s', ignoring: %m", temporary_mount); + /* Make the bind mount read-only. */ + r = mount_nofollow_verbose(LOG_DEBUG, NULL, dev, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL); + if (r < 0) + return r; + /* Create the /dev directory if missing. It is more likely to be missing when the service is started * with RootDirectory. This is consistent with mount units creating the mount points when missing. */ (void) mkdir_p_label(mount_entry_path(m), 0755); -- 2.47.3