Re: [PATCH] Set restrictive mount options

Alyssa Ross
2025-12-11T19:04:57Z

[-- Attachment #1: Type: text/plain, Size: 7982 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 12/11/25 07:48, Alyssa Ross wrote:
>> These are mostly copied from systemd, so should be pretty safe in
>> terms of compatibility.
>>
>> Signed-off-by: Alyssa Ross <hi@alyssa.is>
>> ---
>> host/initramfs/etc/fstab | 8 ++++----
>> host/initramfs/etc/init | 2 +-
>> host/rootfs/image/etc/fstab | 12 ++++++------
>> img/app/image/etc/fstab | 12 ++++++------
>> img/app/image/etc/mdev/virtiofs | 2 +-
>> img/app/image/etc/s6-rc/app/run | 4 ++--
>> img/app/scripts/start-virtiofsd.elb | 2 +-
>> vm/app/systemd-sysupdate/download-update | 2 +-
>> vm/sys/net/image/etc/fstab | 12 ++++++------
>> 9 files changed, 28 insertions(+), 28 deletions(-)
>>
>> diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab
>> index 3dfb05ab..9f43a1a9 100644
>> --- a/host/initramfs/etc/fstab
>> +++ b/host/initramfs/etc/fstab
>> @@ -1,5 +1,5 @@
>> # SPDX-License-Identifier: CC0-1.0
>> -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
>> -devtmpfs /dev devtmpfs defaults 0 0
>> -proc /proc proc defaults 0 0
>> -sysfs /sys sysfs defaults 0 0
>> +# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi@alyssa.is>
>> +devtmpfs /dev devtmpfs nosuid 0 0
>
> Should this also be noexec? I don't think anything has any business
> executing something out of devtmpfs.
>
>> +proc /proc proc nosuid,nodev,noexec 0 0
>> +sysfs /sys sysfs nosuid,nodev,noexec 0 0
>> diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init
>> index 71948874..723d2e1b 100755
>> --- a/host/initramfs/etc/init
>> +++ b/host/initramfs/etc/init
>> @@ -42,7 +42,7 @@ if {
>>
>> background { rm /dev/rootfs /dev/verity }
>>
>> -if { mount /dev/mapper/root-verity /mnt/root }
>> +if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root }
>> wait { $mdevd_pid }
>>
>> if { mount --move /proc /mnt/root/proc }
>> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
>> index 6230d910..5c23a374 100644
>> --- a/host/rootfs/image/etc/fstab
>> +++ b/host/rootfs/image/etc/fstab
>> @@ -1,7 +1,7 @@
>> # SPDX-License-Identifier: CC0-1.0
>> -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
>> -proc /proc proc defaults 0 0
>> -devpts /dev/pts devpts gid=5,mode=620 0 0
>> -tmpfs /dev/shm tmpfs defaults 0 0
>> -sysfs /sys sysfs defaults 0 0
>> -tmpfs /tmp tmpfs defaults 0 0
>> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
>> +proc /proc proc nosuid,nodev,noexec 0 0
>> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
>> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0
>> +sysfs /sys sysfs nosuid,nodev,noexec 0 0
>> +tmpfs /tmp tmpfs nosuid,nodev 0 0
>
> Should this be noexec as well?
>
>> diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab
>> index 2dd1f4d8..5f78ab87 100644
>> --- a/img/app/image/etc/fstab
>> +++ b/img/app/image/etc/fstab
>> @@ -1,8 +1,8 @@
>> # SPDX-License-Identifier: CC0-1.0
>> # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi@alyssa.is>
>> -proc /proc proc defaults 0 0
>> -devpts /dev/pts devpts gid=5,mode=620 0 0
>> -tmpfs /dev/shm tmpfs defaults 0 0
>> -sysfs /sys sysfs defaults 0 0
>> -tmpfs /tmp tmpfs defaults 0 0
>> -tmpfs /home/user tmpfs mode=0700,uid=1000,gid=1000 0 0
>> +proc /proc proc nosuid,nodev,noexec 0 0
>> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
>> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0
>> +sysfs /sys sysfs nosuid,nodev,noexec 0 0
>> +tmpfs /tmp tmpfs nosuid,nodev 0 0
>> +tmpfs /home/user tmpfs nodev,mode=0700,uid=1000,gid=1000 0 0
>> diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs
>> index c1fd2834..b6e505bc 100755
>> --- a/img/app/image/etc/mdev/virtiofs
>> +++ b/img/app/image/etc/mdev/virtiofs
>> @@ -7,6 +7,6 @@ background {
>> # virtiofs filesystems, so we only supported a single, hardcoded
>> # filesystem tag for now.
>> if { mkdir -p /run/virtiofs/virtiofs0 }
>> - if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 }
>> + if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 }
>> /etc/mdev/listen virtiofs0
>> }
>> diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run
>> index 0ba1f374..997897de 100755
>> --- a/img/app/image/etc/s6-rc/app/run
>> +++ b/img/app/image/etc/s6-rc/app/run
>> @@ -17,7 +17,7 @@ foreground {
>> if { modprobe loop }
>> if {
>> backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset }
>> - mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt
>> + mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt
>> }
>> s6-setuidgid user
>> export APPIMAGE /run/virtiofs/virtiofs0/config/run
>> @@ -42,7 +42,7 @@ foreground {
>> nix {
>> if {
>> mount -t overlay
>> - -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
>> + -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
>> store /nix/store
>> }
>>
>> diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb
>> index e4d265f0..cedce9ae 100755
>> --- a/img/app/scripts/start-virtiofsd.elb
>> +++ b/img/app/scripts/start-virtiofsd.elb
>> @@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock
>> background {
>> if { mkdir -p build/fs }
>> unshare -rUm
>> - if { mount -t tmpfs fs build/fs }
>> + if { mount -t tmpfs -o nosuid,nodev fs build/fs }
>> if { mkdir build/fs/config }
>> if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config }
>> importas -SsD virtiofsd VIRTIOFSD
>> diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update
>> index facf7f52..b397f238 100755
>> --- a/vm/app/systemd-sysupdate/download-update
>> +++ b/vm/app/systemd-sysupdate/download-update
>> @@ -5,7 +5,7 @@
>> export LC_ALL C
>> export LANGUAGE C
>> unshare -mr
>> -if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }
>> +if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }
>
> Feel free to add noexec and nosymfollow to this. Unless I am very
> much mistaken, the updater should be fine with both.
>
>> backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX }
>> # Not a useless use of cat: if there are NUL bytes in the URL
>> # busybox's awk might misbehave.
>> diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab
>> index a0b62fa5..4c240544 100644
>> --- a/vm/sys/net/image/etc/fstab
>> +++ b/vm/sys/net/image/etc/fstab
>> @@ -1,8 +1,8 @@
>> # SPDX-License-Identifier: CC0-1.0
>> -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
>> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
>> # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
>> -proc /proc proc defaults 0 0
>> -devpts /dev/pts devpts gid=5,mode=620 0 0
>> -tmpfs /dev/shm tmpfs defaults 0 0
>> -sysfs /sys sysfs defaults 0 0
>> -bpffs /sys/fs/bpf bpf defaults 0 0
>> +proc /proc proc nosuid,nodev,noexec 0 0
>> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0
>> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0
>> +sysfs /sys sysfs nosuid,nodev,noexec 0 0
>> +bpffs /sys/fs/bpf bpf nosuid,nodev,noexec,mode=700 0 0
>>
>> base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f
>
> There might be additional improvements that can be made, but
> those can come later, so:
>
> Acked-by: Demi Marie Obenour <demiobenour@gmail.com>
>
> with or without the suggested changes.

Alright, I'll test and commit this with the updater changes, and follow
up separately on the others.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]