[PATCH] Set restrictive mount options

[Alyssa Ross <hi@alyssa.is>]

These are mostly copied from systemd, so should be pretty safe in
terms of compatibility.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
 host/initramfs/etc/fstab                 |  8 ++++----
 host/initramfs/etc/init                  |  2 +-
 host/rootfs/image/etc/fstab              | 12 ++++++------
 img/app/image/etc/fstab                  | 12 ++++++------
 img/app/image/etc/mdev/virtiofs          |  2 +-
 img/app/image/etc/s6-rc/app/run          |  4 ++--
 img/app/scripts/start-virtiofsd.elb      |  2 +-
 vm/app/systemd-sysupdate/download-update |  2 +-
 vm/sys/net/image/etc/fstab               | 12 ++++++------
 9 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab
index 3dfb05ab..9f43a1a9 100644
--- a/host/initramfs/etc/fstab
+++ b/host/initramfs/etc/fstab
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-devtmpfs	/dev	devtmpfs	defaults	0	0
-proc		/proc	proc		defaults	0	0
-sysfs		/sys	sysfs		defaults	0	0
+# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi@alyssa.is>
+devtmpfs	/dev	devtmpfs	nosuid			0	0
+proc		/proc	proc		nosuid,nodev,noexec	0	0
+sysfs		/sys	sysfs		nosuid,nodev,noexec	0	0
diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init
index 71948874..723d2e1b 100755
--- a/host/initramfs/etc/init
+++ b/host/initramfs/etc/init
@@ -42,7 +42,7 @@ if {
 
 background { rm /dev/rootfs /dev/verity }
 
-if { mount /dev/mapper/root-verity /mnt/root }
+if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root }
 wait { $mdevd_pid }
 
 if { mount --move /proc /mnt/root/proc }
diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
index 6230d910..5c23a374 100644
--- a/host/rootfs/image/etc/fstab
+++ b/host/rootfs/image/etc/fstab
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
-proc	/proc		proc	defaults	0	0
-devpts	/dev/pts	devpts	gid=5,mode=620	0	0
-tmpfs	/dev/shm	tmpfs	defaults	0	0
-sysfs	/sys		sysfs	defaults	0	0
-tmpfs	/tmp		tmpfs	defaults	0	0
+# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
+proc	/proc		proc	nosuid,nodev,noexec		0	0
+devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620	0	0
+tmpfs	/dev/shm	tmpfs	nosuid,nodev			0	0
+sysfs	/sys		sysfs	nosuid,nodev,noexec		0	0
+tmpfs	/tmp		tmpfs	nosuid,nodev			0	0
diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab
index 2dd1f4d8..5f78ab87 100644
--- a/img/app/image/etc/fstab
+++ b/img/app/image/etc/fstab
@@ -1,8 +1,8 @@
 # SPDX-License-Identifier: CC0-1.0
 # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi@alyssa.is>
-proc	/proc		proc	defaults			0	0
-devpts	/dev/pts	devpts	gid=5,mode=620			0	0
-tmpfs	/dev/shm	tmpfs	defaults			0	0
-sysfs	/sys		sysfs	defaults			0	0
-tmpfs	/tmp		tmpfs	defaults			0	0
-tmpfs	/home/user	tmpfs	mode=0700,uid=1000,gid=1000	0	0
+proc	/proc		proc	nosuid,nodev,noexec		0	0
+devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620	0	0
+tmpfs	/dev/shm	tmpfs	nosuid,nodev				0	0
+sysfs	/sys		sysfs	nosuid,nodev,noexec			0	0
+tmpfs	/tmp		tmpfs	nosuid,nodev				0	0
+tmpfs	/home/user	tmpfs	nodev,mode=0700,uid=1000,gid=1000	0	0
diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs
index c1fd2834..b6e505bc 100755
--- a/img/app/image/etc/mdev/virtiofs
+++ b/img/app/image/etc/mdev/virtiofs
@@ -7,6 +7,6 @@ background {
   # virtiofs filesystems, so we only supported a single, hardcoded
   # filesystem tag for now.
   if { mkdir -p /run/virtiofs/virtiofs0 }
-  if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 }
+  if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 }
   /etc/mdev/listen virtiofs0
 }
diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run
index 0ba1f374..997897de 100755
--- a/img/app/image/etc/s6-rc/app/run
+++ b/img/app/image/etc/s6-rc/app/run
@@ -17,7 +17,7 @@ foreground {
       if { modprobe loop }
       if {
         backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset }
-        mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt
+        mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt
       }
       s6-setuidgid user
       export APPIMAGE /run/virtiofs/virtiofs0/config/run
@@ -42,7 +42,7 @@ foreground {
     nix {
       if {
 	mount -t overlay
-	  -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
+	  -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
 	  store /nix/store
       }
 
diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb
index e4d265f0..cedce9ae 100755
--- a/img/app/scripts/start-virtiofsd.elb
+++ b/img/app/scripts/start-virtiofsd.elb
@@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock
 background {
   if { mkdir -p build/fs }
   unshare -rUm
-  if { mount -t tmpfs fs build/fs }
+  if { mount -t tmpfs -o nosuid,nodev fs build/fs }
   if { mkdir build/fs/config }
   if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config }
   importas -SsD virtiofsd VIRTIOFSD
diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update
index facf7f52..b397f238 100755
--- a/vm/app/systemd-sysupdate/download-update
+++ b/vm/app/systemd-sysupdate/download-update
@@ -5,7 +5,7 @@
 export LC_ALL C
 export LANGUAGE C
 unshare -mr
-if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }
+if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }
 backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX }
 # Not a useless use of cat: if there are NUL bytes in the URL
 # busybox's awk might misbehave.
diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab
index a0b62fa5..4c240544 100644
--- a/vm/sys/net/image/etc/fstab
+++ b/vm/sys/net/image/etc/fstab
@@ -1,8 +1,8 @@
 # SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
 # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
-proc	/proc		proc	defaults	0	0
-devpts	/dev/pts	devpts	gid=5,mode=620	0	0
-tmpfs	/dev/shm	tmpfs	defaults	0	0
-sysfs	/sys		sysfs	defaults	0	0
-bpffs	/sys/fs/bpf	bpf	defaults	0	0
+proc	/proc		proc	nosuid,nodev,noexec		0	0
+devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620	0	0
+tmpfs	/dev/shm	tmpfs	nosuid,nodev			0	0
+sysfs	/sys		sysfs	nosuid,nodev,noexec		0	0
+bpffs	/sys/fs/bpf	bpf	nosuid,nodev,noexec,mode=700	0	0

base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f
-- 
2.51.0