Re: [PATCH] Set restrictive mount options

[Demi Marie Obenour <demiobenour@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 7683 bytes --]

On 12/11/25 07:48, Alyssa Ross wrote:
> These are mostly copied from systemd, so should be pretty safe in
> terms of compatibility.
> 
> Signed-off-by: Alyssa Ross <hi@alyssa.is>
> ---
>  host/initramfs/etc/fstab                 |  8 ++++----
>  host/initramfs/etc/init                  |  2 +-
>  host/rootfs/image/etc/fstab              | 12 ++++++------
>  img/app/image/etc/fstab                  | 12 ++++++------
>  img/app/image/etc/mdev/virtiofs          |  2 +-
>  img/app/image/etc/s6-rc/app/run          |  4 ++--
>  img/app/scripts/start-virtiofsd.elb      |  2 +-
>  vm/app/systemd-sysupdate/download-update |  2 +-
>  vm/sys/net/image/etc/fstab               | 12 ++++++------
>  9 files changed, 28 insertions(+), 28 deletions(-)
> 
> diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab
> index 3dfb05ab..9f43a1a9 100644
> --- a/host/initramfs/etc/fstab
> +++ b/host/initramfs/etc/fstab
> @@ -1,5 +1,5 @@
>  # SPDX-License-Identifier: CC0-1.0
> -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> -devtmpfs	/dev	devtmpfs	defaults	0	0
> -proc		/proc	proc		defaults	0	0
> -sysfs		/sys	sysfs		defaults	0	0
> +# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi@alyssa.is>
> +devtmpfs	/dev	devtmpfs	nosuid			0	0

Should this also be noexec?  I don't think anything has any business
executing something out of devtmpfs.

> +proc		/proc	proc		nosuid,nodev,noexec	0	0
> +sysfs		/sys	sysfs		nosuid,nodev,noexec	0	0
> diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init
> index 71948874..723d2e1b 100755
> --- a/host/initramfs/etc/init
> +++ b/host/initramfs/etc/init
> @@ -42,7 +42,7 @@ if {
>  
>  background { rm /dev/rootfs /dev/verity }
>  
> -if { mount /dev/mapper/root-verity /mnt/root }
> +if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root }
>  wait { $mdevd_pid }
>  
>  if { mount --move /proc /mnt/root/proc }
> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
> index 6230d910..5c23a374 100644
> --- a/host/rootfs/image/etc/fstab
> +++ b/host/rootfs/image/etc/fstab
> @@ -1,7 +1,7 @@
>  # SPDX-License-Identifier: CC0-1.0
> -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
> -proc	/proc		proc	defaults	0	0
> -devpts	/dev/pts	devpts	gid=5,mode=620	0	0
> -tmpfs	/dev/shm	tmpfs	defaults	0	0
> -sysfs	/sys		sysfs	defaults	0	0
> -tmpfs	/tmp		tmpfs	defaults	0	0
> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
> +proc	/proc		proc	nosuid,nodev,noexec		0	0
> +devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620	0	0
> +tmpfs	/dev/shm	tmpfs	nosuid,nodev			0	0
> +sysfs	/sys		sysfs	nosuid,nodev,noexec		0	0
> +tmpfs	/tmp		tmpfs	nosuid,nodev			0	0

Should this be noexec as well?

> diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab
> index 2dd1f4d8..5f78ab87 100644
> --- a/img/app/image/etc/fstab
> +++ b/img/app/image/etc/fstab
> @@ -1,8 +1,8 @@
>  # SPDX-License-Identifier: CC0-1.0
>  # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi@alyssa.is>
> -proc	/proc		proc	defaults			0	0
> -devpts	/dev/pts	devpts	gid=5,mode=620			0	0
> -tmpfs	/dev/shm	tmpfs	defaults			0	0
> -sysfs	/sys		sysfs	defaults			0	0
> -tmpfs	/tmp		tmpfs	defaults			0	0
> -tmpfs	/home/user	tmpfs	mode=0700,uid=1000,gid=1000	0	0
> +proc	/proc		proc	nosuid,nodev,noexec		0	0
> +devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620	0	0
> +tmpfs	/dev/shm	tmpfs	nosuid,nodev				0	0
> +sysfs	/sys		sysfs	nosuid,nodev,noexec			0	0
> +tmpfs	/tmp		tmpfs	nosuid,nodev				0	0
> +tmpfs	/home/user	tmpfs	nodev,mode=0700,uid=1000,gid=1000	0	0
> diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs
> index c1fd2834..b6e505bc 100755
> --- a/img/app/image/etc/mdev/virtiofs
> +++ b/img/app/image/etc/mdev/virtiofs
> @@ -7,6 +7,6 @@ background {
>    # virtiofs filesystems, so we only supported a single, hardcoded
>    # filesystem tag for now.
>    if { mkdir -p /run/virtiofs/virtiofs0 }
> -  if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 }
> +  if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 }
>    /etc/mdev/listen virtiofs0
>  }
> diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run
> index 0ba1f374..997897de 100755
> --- a/img/app/image/etc/s6-rc/app/run
> +++ b/img/app/image/etc/s6-rc/app/run
> @@ -17,7 +17,7 @@ foreground {
>        if { modprobe loop }
>        if {
>          backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset }
> -        mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt
> +        mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt
>        }
>        s6-setuidgid user
>        export APPIMAGE /run/virtiofs/virtiofs0/config/run
> @@ -42,7 +42,7 @@ foreground {
>      nix {
>        if {
>  	mount -t overlay
> -	  -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
> +	  -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store
>  	  store /nix/store
>        }
>  
> diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb
> index e4d265f0..cedce9ae 100755
> --- a/img/app/scripts/start-virtiofsd.elb
> +++ b/img/app/scripts/start-virtiofsd.elb
> @@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock
>  background {
>    if { mkdir -p build/fs }
>    unshare -rUm
> -  if { mount -t tmpfs fs build/fs }
> +  if { mount -t tmpfs -o nosuid,nodev fs build/fs }
>    if { mkdir build/fs/config }
>    if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config }
>    importas -SsD virtiofsd VIRTIOFSD
> diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update
> index facf7f52..b397f238 100755
> --- a/vm/app/systemd-sysupdate/download-update
> +++ b/vm/app/systemd-sysupdate/download-update
> @@ -5,7 +5,7 @@
>  export LC_ALL C
>  export LANGUAGE C
>  unshare -mr
> -if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }
> +if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc }

Feel free to add noexec and nosymfollow to this.  Unless I am very
much mistaken, the updater should be fine with both.

>  backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX }
>  # Not a useless use of cat: if there are NUL bytes in the URL
>  # busybox's awk might misbehave.
> diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab
> index a0b62fa5..4c240544 100644
> --- a/vm/sys/net/image/etc/fstab
> +++ b/vm/sys/net/image/etc/fstab
> @@ -1,8 +1,8 @@
>  # SPDX-License-Identifier: CC0-1.0
> -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
>  # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
> -proc	/proc		proc	defaults	0	0
> -devpts	/dev/pts	devpts	gid=5,mode=620	0	0
> -tmpfs	/dev/shm	tmpfs	defaults	0	0
> -sysfs	/sys		sysfs	defaults	0	0
> -bpffs	/sys/fs/bpf	bpf	defaults	0	0
> +proc	/proc		proc	nosuid,nodev,noexec		0	0
> +devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620	0	0
> +tmpfs	/dev/shm	tmpfs	nosuid,nodev			0	0
> +sysfs	/sys		sysfs	nosuid,nodev,noexec		0	0
> +bpffs	/sys/fs/bpf	bpf	nosuid,nodev,noexec,mode=700	0	0
> 
> base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f

There might be additional improvements that can be made, but
those can come later, so:

Acked-by: Demi Marie Obenour <demiobenour@gmail.com>

with or without the suggested changes.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]