On 12/11/25 07:48, Alyssa Ross wrote: > These are mostly copied from systemd, so should be pretty safe in > terms of compatibility. > > Signed-off-by: Alyssa Ross > --- > host/initramfs/etc/fstab | 8 ++++---- > host/initramfs/etc/init | 2 +- > host/rootfs/image/etc/fstab | 12 ++++++------ > img/app/image/etc/fstab | 12 ++++++------ > img/app/image/etc/mdev/virtiofs | 2 +- > img/app/image/etc/s6-rc/app/run | 4 ++-- > img/app/scripts/start-virtiofsd.elb | 2 +- > vm/app/systemd-sysupdate/download-update | 2 +- > vm/sys/net/image/etc/fstab | 12 ++++++------ > 9 files changed, 28 insertions(+), 28 deletions(-) > > diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab > index 3dfb05ab..9f43a1a9 100644 > --- a/host/initramfs/etc/fstab > +++ b/host/initramfs/etc/fstab > @@ -1,5 +1,5 @@ > # SPDX-License-Identifier: CC0-1.0 > -# SPDX-FileCopyrightText: 2021 Alyssa Ross > -devtmpfs /dev devtmpfs defaults 0 0 > -proc /proc proc defaults 0 0 > -sysfs /sys sysfs defaults 0 0 > +# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross > +devtmpfs /dev devtmpfs nosuid 0 0 Should this also be noexec? I don't think anything has any business executing something out of devtmpfs. > +proc /proc proc nosuid,nodev,noexec 0 0 > +sysfs /sys sysfs nosuid,nodev,noexec 0 0 > diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init > index 71948874..723d2e1b 100755 > --- a/host/initramfs/etc/init > +++ b/host/initramfs/etc/init > @@ -42,7 +42,7 @@ if { > > background { rm /dev/rootfs /dev/verity } > > -if { mount /dev/mapper/root-verity /mnt/root } > +if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root } > wait { $mdevd_pid } > > if { mount --move /proc /mnt/root/proc } > diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab > index 6230d910..5c23a374 100644 > --- a/host/rootfs/image/etc/fstab > +++ b/host/rootfs/image/etc/fstab > @@ -1,7 +1,7 @@ > # SPDX-License-Identifier: CC0-1.0 > -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross > -proc /proc proc defaults 0 0 > -devpts /dev/pts devpts gid=5,mode=620 0 0 > -tmpfs /dev/shm tmpfs defaults 0 0 > -sysfs /sys sysfs defaults 0 0 > -tmpfs /tmp tmpfs defaults 0 0 > +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross > +proc /proc proc nosuid,nodev,noexec 0 0 > +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 > +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 > +sysfs /sys sysfs nosuid,nodev,noexec 0 0 > +tmpfs /tmp tmpfs nosuid,nodev 0 0 Should this be noexec as well? > diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab > index 2dd1f4d8..5f78ab87 100644 > --- a/img/app/image/etc/fstab > +++ b/img/app/image/etc/fstab > @@ -1,8 +1,8 @@ > # SPDX-License-Identifier: CC0-1.0 > # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross > -proc /proc proc defaults 0 0 > -devpts /dev/pts devpts gid=5,mode=620 0 0 > -tmpfs /dev/shm tmpfs defaults 0 0 > -sysfs /sys sysfs defaults 0 0 > -tmpfs /tmp tmpfs defaults 0 0 > -tmpfs /home/user tmpfs mode=0700,uid=1000,gid=1000 0 0 > +proc /proc proc nosuid,nodev,noexec 0 0 > +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 > +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 > +sysfs /sys sysfs nosuid,nodev,noexec 0 0 > +tmpfs /tmp tmpfs nosuid,nodev 0 0 > +tmpfs /home/user tmpfs nodev,mode=0700,uid=1000,gid=1000 0 0 > diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs > index c1fd2834..b6e505bc 100755 > --- a/img/app/image/etc/mdev/virtiofs > +++ b/img/app/image/etc/mdev/virtiofs > @@ -7,6 +7,6 @@ background { > # virtiofs filesystems, so we only supported a single, hardcoded > # filesystem tag for now. > if { mkdir -p /run/virtiofs/virtiofs0 } > - if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 } > + if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 } > /etc/mdev/listen virtiofs0 > } > diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run > index 0ba1f374..997897de 100755 > --- a/img/app/image/etc/s6-rc/app/run > +++ b/img/app/image/etc/s6-rc/app/run > @@ -17,7 +17,7 @@ foreground { > if { modprobe loop } > if { > backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset } > - mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt > + mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt > } > s6-setuidgid user > export APPIMAGE /run/virtiofs/virtiofs0/config/run > @@ -42,7 +42,7 @@ foreground { > nix { > if { > mount -t overlay > - -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store > + -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store > store /nix/store > } > > diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb > index e4d265f0..cedce9ae 100755 > --- a/img/app/scripts/start-virtiofsd.elb > +++ b/img/app/scripts/start-virtiofsd.elb > @@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock > background { > if { mkdir -p build/fs } > unshare -rUm > - if { mount -t tmpfs fs build/fs } > + if { mount -t tmpfs -o nosuid,nodev fs build/fs } > if { mkdir build/fs/config } > if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config } > importas -SsD virtiofsd VIRTIOFSD > diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update > index facf7f52..b397f238 100755 > --- a/vm/app/systemd-sysupdate/download-update > +++ b/vm/app/systemd-sysupdate/download-update > @@ -5,7 +5,7 @@ > export LC_ALL C > export LANGUAGE C > unshare -mr > -if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } > +if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } Feel free to add noexec and nosymfollow to this. Unless I am very much mistaken, the updater should be fine with both. > backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } > # Not a useless use of cat: if there are NUL bytes in the URL > # busybox's awk might misbehave. > diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab > index a0b62fa5..4c240544 100644 > --- a/vm/sys/net/image/etc/fstab > +++ b/vm/sys/net/image/etc/fstab > @@ -1,8 +1,8 @@ > # SPDX-License-Identifier: CC0-1.0 > -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross > +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross > # SPDX-FileCopyrightText: 2025 Yureka Lilian > -proc /proc proc defaults 0 0 > -devpts /dev/pts devpts gid=5,mode=620 0 0 > -tmpfs /dev/shm tmpfs defaults 0 0 > -sysfs /sys sysfs defaults 0 0 > -bpffs /sys/fs/bpf bpf defaults 0 0 > +proc /proc proc nosuid,nodev,noexec 0 0 > +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 > +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 > +sysfs /sys sysfs nosuid,nodev,noexec 0 0 > +bpffs /sys/fs/bpf bpf nosuid,nodev,noexec,mode=700 0 0 > > base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f There might be additional improvements that can be made, but those can come later, so: Acked-by: Demi Marie Obenour with or without the suggested changes. -- Sincerely, Demi Marie Obenour (she/her/hers)