[PATCH] Set restrictive mount options

Alyssa Ross
2025-12-11T12:48:41Z

These are mostly copied from systemd, so should be pretty safe in
terms of compatibility.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
host/initramfs/etc/fstab | 8 ++++----
host/initramfs/etc/init | 2 +-
host/rootfs/image/etc/fstab | 12 ++++++------
img/app/image/etc/fstab | 12 ++++++------
img/app/image/etc/mdev/virtiofs | 2 +-
img/app/image/etc/s6-rc/app/run | 4 ++--
img/app/scripts/start-virtiofsd.elb | 2 +-
vm/app/systemd-sysupdate/download-update | 2 +-
vm/sys/net/image/etc/fstab | 12 ++++++------
9 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab
index 3dfb05ab..9f43a1a9 100644
--- a/host/initramfs/etc/fstab
+++ b/host/initramfs/etc/fstab
@@ -1,5 +1,5 @@
# SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
-devtmpfs /dev devtmpfs defaults 0 0
-proc /proc proc defaults 0 0
-sysfs /sys sysfs defaults 0 0
+# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi@alyssa.is>
+devtmpfs /dev devtmpfs nosuid 0 0
+proc /proc proc nosuid,nodev,noexec 0 0
+sysfs /sys sysfs nosuid,nodev,noexec 0 0
diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init
index 71948874..723d2e1b 100755
--- a/host/initramfs/etc/init
+++ b/host/initramfs/etc/init
@@ -42,7 +42,7 @@ if {

background { rm /dev/rootfs /dev/verity }

-if { mount /dev/mapper/root-verity /mnt/root }
+if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root }
wait { $mdevd_pid }

if { mount --move /proc /mnt/root/proc }
diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
index 6230d910..5c23a374 100644
--- a/host/rootfs/image/etc/fstab
+++ b/host/rootfs/image/etc/fstab
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
-proc /proc proc defaults 0 0
-devpts /dev/pts devpts gid=5,mode=620 0 0
-tmpfs /dev/shm tmpfs defaults 0 0
-sysfs /sys sysfs defaults 0 0
-tmpfs /tmp tmpfs defaults 0 0
+# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
+proc /proc proc nosuid,nodev,noexec 0 0
+devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
+tmpfs /dev/shm tmpfs nosuid,nodev 0 0
+sysfs /sys sysfs nosuid,nodev,noexec 0 0
+tmpfs /tmp tmpfs nosuid,nodev 0 0
diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab
index 2dd1f4d8..5f78ab87 100644
--- a/img/app/image/etc/fstab
+++ b/img/app/image/etc/fstab
@@ -1,8 +1,8 @@
# SPDX-License-Identifier: CC0-1.0
# SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi@alyssa.is>
-proc /proc proc defaults 0 0
-devpts /dev/pts devpts gid=5,mode=620 0 0
-tmpfs /dev/shm tmpfs defaults 0 0
-sysfs /sys sysfs defaults 0 0
-tmpfs /tmp tmpfs defaults 0 0
-tmpfs /home/user tmpfs mode=0700,uid=1000,gid=1000 0 0
+proc /proc proc nosuid,nodev,noexec 0 0
+devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
+tmpfs /dev/shm tmpfs nosuid,nodev 0 0
+sysfs /sys sysfs nosuid,nodev,noexec 0 0
+tmpfs /tmp tmpfs nosuid,nodev 0 0
+tmpfs /home/user tmpfs nodev,mode=0700,uid=1000,gid=1000 0 0
diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs
index c1fd2834..b6e505bc 100755
--- a/img/app/image/etc/mdev/virtiofs
+++ b/img/app/image/etc/mdev/virtiofs
@@ -7,6 +7,6 @@ background {
# virtiofs filesystems, so we only supported a single, hardcoded
# filesystem tag for now.
if { mkdir -p /run/virtiofs/virtiofs0 }
- if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 }
+ if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 }
/etc/mdev/listen virtiofs0
}
diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run
index 0ba1f374..997897de 100755
--- a/img/app/image/etc/s6-rc/app/run
+++ b/img/app/image/etc/s6-rc/app/run
@@ -17,7 +17,7 @@ foreground {
if { modprobe loop }
if {
backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset }
- mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt
+ mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt
}
s6-setuidgid user
export APPIMAGE /run/virtiofs/virtiofs0/config/run
@@ -42,7 +42,7 @@ foreground {
nix {
if {
mount -t overlay
- -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
+ -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
store /nix/store
}

diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb
index e4d265f0..cedce9ae 100755
--- a/img/app/scripts/start-virtiofsd.elb
+++ b/img/app/scripts/start-virtiofsd.elb
@@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock
background {
if { mkdir -p build/fs }
unshare -rUm
- if { mount -t tmpfs fs build/fs }
+ if { mount -t tmpfs -o nosuid,nodev fs build/fs }
if { mkdir build/fs/config }
if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config }
importas -SsD virtiofsd VIRTIOFSD
diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update
index facf7f52..b397f238 100755
--- a/vm/app/systemd-sysupdate/download-update
+++ b/vm/app/systemd-sysupdate/download-update
@@ -5,7 +5,7 @@
export LC_ALL C
export LANGUAGE C
unshare -mr
-if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }
+if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }
backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX }
# Not a useless use of cat: if there are NUL bytes in the URL
# busybox's awk might misbehave.
diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab
index a0b62fa5..4c240544 100644
--- a/vm/sys/net/image/etc/fstab
+++ b/vm/sys/net/image/etc/fstab
@@ -1,8 +1,8 @@
# SPDX-License-Identifier: CC0-1.0
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
-proc /proc proc defaults 0 0
-devpts /dev/pts devpts gid=5,mode=620 0 0
-tmpfs /dev/shm tmpfs defaults 0 0
-sysfs /sys sysfs defaults 0 0
-bpffs /sys/fs/bpf bpf defaults 0 0
+proc /proc proc nosuid,nodev,noexec 0 0
+devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
+tmpfs /dev/shm tmpfs nosuid,nodev 0 0
+sysfs /sys sysfs nosuid,nodev,noexec 0 0
+bpffs /sys/fs/bpf bpf nosuid,nodev,noexec,mode=700 0 0

base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f
--
2.51.0