Re: [PATCH] Set restrictive mount options

Demi Marie Obenour
2025-12-11T18:08:03Z

[-- Attachment #1.1.1: Type: text/plain, Size: 7683 bytes --]

On 12/11/25 07:48, Alyssa Ross wrote:
> These are mostly copied from systemd, so should be pretty safe in
> terms of compatibility.
>
> Signed-off-by: Alyssa Ross <hi@alyssa.is>
> ---
> host/initramfs/etc/fstab | 8 ++++----
> host/initramfs/etc/init | 2 +-
> host/rootfs/image/etc/fstab | 12 ++++++------
> img/app/image/etc/fstab | 12 ++++++------
> img/app/image/etc/mdev/virtiofs | 2 +-
> img/app/image/etc/s6-rc/app/run | 4 ++--
> img/app/scripts/start-virtiofsd.elb | 2 +-
> vm/app/systemd-sysupdate/download-update | 2 +-
> vm/sys/net/image/etc/fstab | 12 ++++++------
> 9 files changed, 28 insertions(+), 28 deletions(-)
>
> diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab
> index 3dfb05ab..9f43a1a9 100644
> --- a/host/initramfs/etc/fstab
> +++ b/host/initramfs/etc/fstab
> @@ -1,5 +1,5 @@
> # SPDX-License-Identifier: CC0-1.0
> -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> -devtmpfs /dev devtmpfs defaults 0 0
> -proc /proc proc defaults 0 0
> -sysfs /sys sysfs defaults 0 0
> +# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi@alyssa.is>
> +devtmpfs /dev devtmpfs nosuid 0 0

Should this also be noexec? I don't think anything has any business
executing something out of devtmpfs.

> +proc /proc proc nosuid,nodev,noexec 0 0
> +sysfs /sys sysfs nosuid,nodev,noexec 0 0
> diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init
> index 71948874..723d2e1b 100755
> --- a/host/initramfs/etc/init
> +++ b/host/initramfs/etc/init
> @@ -42,7 +42,7 @@ if {
>
> background { rm /dev/rootfs /dev/verity }
>
> -if { mount /dev/mapper/root-verity /mnt/root }
> +if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root }
> wait { $mdevd_pid }
>
> if { mount --move /proc /mnt/root/proc }
> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
> index 6230d910..5c23a374 100644
> --- a/host/rootfs/image/etc/fstab
> +++ b/host/rootfs/image/etc/fstab
> @@ -1,7 +1,7 @@
> # SPDX-License-Identifier: CC0-1.0
> -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
> -proc /proc proc defaults 0 0
> -devpts /dev/pts devpts gid=5,mode=620 0 0
> -tmpfs /dev/shm tmpfs defaults 0 0
> -sysfs /sys sysfs defaults 0 0
> -tmpfs /tmp tmpfs defaults 0 0
> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
> +proc /proc proc nosuid,nodev,noexec 0 0
> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0
> +sysfs /sys sysfs nosuid,nodev,noexec 0 0
> +tmpfs /tmp tmpfs nosuid,nodev 0 0

Should this be noexec as well?

> diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab
> index 2dd1f4d8..5f78ab87 100644
> --- a/img/app/image/etc/fstab
> +++ b/img/app/image/etc/fstab
> @@ -1,8 +1,8 @@
> # SPDX-License-Identifier: CC0-1.0
> # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi@alyssa.is>
> -proc /proc proc defaults 0 0
> -devpts /dev/pts devpts gid=5,mode=620 0 0
> -tmpfs /dev/shm tmpfs defaults 0 0
> -sysfs /sys sysfs defaults 0 0
> -tmpfs /tmp tmpfs defaults 0 0
> -tmpfs /home/user tmpfs mode=0700,uid=1000,gid=1000 0 0
> +proc /proc proc nosuid,nodev,noexec 0 0
> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0
> +sysfs /sys sysfs nosuid,nodev,noexec 0 0
> +tmpfs /tmp tmpfs nosuid,nodev 0 0
> +tmpfs /home/user tmpfs nodev,mode=0700,uid=1000,gid=1000 0 0
> diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs
> index c1fd2834..b6e505bc 100755
> --- a/img/app/image/etc/mdev/virtiofs
> +++ b/img/app/image/etc/mdev/virtiofs
> @@ -7,6 +7,6 @@ background {
> # virtiofs filesystems, so we only supported a single, hardcoded
> # filesystem tag for now.
> if { mkdir -p /run/virtiofs/virtiofs0 }
> - if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 }
> + if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 }
> /etc/mdev/listen virtiofs0
> }
> diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run
> index 0ba1f374..997897de 100755
> --- a/img/app/image/etc/s6-rc/app/run
> +++ b/img/app/image/etc/s6-rc/app/run
> @@ -17,7 +17,7 @@ foreground {
> if { modprobe loop }
> if {
> backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset }
> - mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt
> + mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt
> }
> s6-setuidgid user
> export APPIMAGE /run/virtiofs/virtiofs0/config/run
> @@ -42,7 +42,7 @@ foreground {
> nix {
> if {
> mount -t overlay
> - -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
> + -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
> store /nix/store
> }
>
> diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb
> index e4d265f0..cedce9ae 100755
> --- a/img/app/scripts/start-virtiofsd.elb
> +++ b/img/app/scripts/start-virtiofsd.elb
> @@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock
> background {
> if { mkdir -p build/fs }
> unshare -rUm
> - if { mount -t tmpfs fs build/fs }
> + if { mount -t tmpfs -o nosuid,nodev fs build/fs }
> if { mkdir build/fs/config }
> if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config }
> importas -SsD virtiofsd VIRTIOFSD
> diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update
> index facf7f52..b397f238 100755
> --- a/vm/app/systemd-sysupdate/download-update
> +++ b/vm/app/systemd-sysupdate/download-update
> @@ -5,7 +5,7 @@
> export LC_ALL C
> export LANGUAGE C
> unshare -mr
> -if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }
> +if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }

Feel free to add noexec and nosymfollow to this. Unless I am very
much mistaken, the updater should be fine with both.

> backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX }
> # Not a useless use of cat: if there are NUL bytes in the URL
> # busybox's awk might misbehave.
> diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab
> index a0b62fa5..4c240544 100644
> --- a/vm/sys/net/image/etc/fstab
> +++ b/vm/sys/net/image/etc/fstab
> @@ -1,8 +1,8 @@
> # SPDX-License-Identifier: CC0-1.0
> -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
> # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
> -proc /proc proc defaults 0 0
> -devpts /dev/pts devpts gid=5,mode=620 0 0
> -tmpfs /dev/shm tmpfs defaults 0 0
> -sysfs /sys sysfs defaults 0 0
> -bpffs /sys/fs/bpf bpf defaults 0 0
> +proc /proc proc nosuid,nodev,noexec 0 0
> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0
> +sysfs /sys sysfs nosuid,nodev,noexec 0 0
> +bpffs /sys/fs/bpf bpf nosuid,nodev,noexec,mode=700 0 0
>
> base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f

There might be additional improvements that can be made, but
those can come later, so:

Acked-by: Demi Marie Obenour <demiobenour@gmail.com>

with or without the suggested changes.
--
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]