From 05794f5c48b806ddf7e932ed9b0a72e39b641971 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 5 Jan 2024 16:42:46 +0100 Subject: [PATCH] nspawn: set read-only access mode on two /run/host/ files The diectory is mounted read-only anyway, hence this doesn't do much, but let's lock this down on every level we can. --- src/nspawn/nspawn.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 9e53c51f1ac..3ace3520b9c 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -3946,11 +3946,11 @@ static int outer_child( /* The same stuff as the $container env var, but nicely readable for the entire payload */ p = prefix_roota(directory, "/run/host/container-manager"); - (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE); + (void) write_string_file(p, arg_container_service_name, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_MODE_0444); /* The same stuff as the $container_uuid env var */ p = prefix_roota(directory, "/run/host/container-uuid"); - (void) write_string_filef(p, WRITE_STRING_FILE_CREATE, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid)); + (void) write_string_filef(p, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_MODE_0444, SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid)); if (!arg_use_cgns) { r = mount_cgroups( -- 2.47.3