Demi Marie Obenour writes: > On 12/11/25 07:48, Alyssa Ross wrote: >> These are mostly copied from systemd, so should be pretty safe in >> terms of compatibility. >> >> Signed-off-by: Alyssa Ross >> --- >> host/initramfs/etc/fstab | 8 ++++---- >> host/initramfs/etc/init | 2 +- >> host/rootfs/image/etc/fstab | 12 ++++++------ >> img/app/image/etc/fstab | 12 ++++++------ >> img/app/image/etc/mdev/virtiofs | 2 +- >> img/app/image/etc/s6-rc/app/run | 4 ++-- >> img/app/scripts/start-virtiofsd.elb | 2 +- >> vm/app/systemd-sysupdate/download-update | 2 +- >> vm/sys/net/image/etc/fstab | 12 ++++++------ >> 9 files changed, 28 insertions(+), 28 deletions(-) >> >> diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab >> index 3dfb05ab..9f43a1a9 100644 >> --- a/host/initramfs/etc/fstab >> +++ b/host/initramfs/etc/fstab >> @@ -1,5 +1,5 @@ >> # SPDX-License-Identifier: CC0-1.0 >> -# SPDX-FileCopyrightText: 2021 Alyssa Ross >> -devtmpfs /dev devtmpfs defaults 0 0 >> -proc /proc proc defaults 0 0 >> -sysfs /sys sysfs defaults 0 0 >> +# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross >> +devtmpfs /dev devtmpfs nosuid 0 0 > > Should this also be noexec? I don't think anything has any business > executing something out of devtmpfs. > >> +proc /proc proc nosuid,nodev,noexec 0 0 >> +sysfs /sys sysfs nosuid,nodev,noexec 0 0 >> diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init >> index 71948874..723d2e1b 100755 >> --- a/host/initramfs/etc/init >> +++ b/host/initramfs/etc/init >> @@ -42,7 +42,7 @@ if { >> >> background { rm /dev/rootfs /dev/verity } >> >> -if { mount /dev/mapper/root-verity /mnt/root } >> +if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root } >> wait { $mdevd_pid } >> >> if { mount --move /proc /mnt/root/proc } >> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab >> index 6230d910..5c23a374 100644 >> --- a/host/rootfs/image/etc/fstab >> +++ b/host/rootfs/image/etc/fstab >> @@ -1,7 +1,7 @@ >> # SPDX-License-Identifier: CC0-1.0 >> -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross >> -proc /proc proc defaults 0 0 >> -devpts /dev/pts devpts gid=5,mode=620 0 0 >> -tmpfs /dev/shm tmpfs defaults 0 0 >> -sysfs /sys sysfs defaults 0 0 >> -tmpfs /tmp tmpfs defaults 0 0 >> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross >> +proc /proc proc nosuid,nodev,noexec 0 0 >> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 >> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 >> +sysfs /sys sysfs nosuid,nodev,noexec 0 0 >> +tmpfs /tmp tmpfs nosuid,nodev 0 0 > > Should this be noexec as well? > >> diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab >> index 2dd1f4d8..5f78ab87 100644 >> --- a/img/app/image/etc/fstab >> +++ b/img/app/image/etc/fstab >> @@ -1,8 +1,8 @@ >> # SPDX-License-Identifier: CC0-1.0 >> # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross >> -proc /proc proc defaults 0 0 >> -devpts /dev/pts devpts gid=5,mode=620 0 0 >> -tmpfs /dev/shm tmpfs defaults 0 0 >> -sysfs /sys sysfs defaults 0 0 >> -tmpfs /tmp tmpfs defaults 0 0 >> -tmpfs /home/user tmpfs mode=0700,uid=1000,gid=1000 0 0 >> +proc /proc proc nosuid,nodev,noexec 0 0 >> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 >> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 >> +sysfs /sys sysfs nosuid,nodev,noexec 0 0 >> +tmpfs /tmp tmpfs nosuid,nodev 0 0 >> +tmpfs /home/user tmpfs nodev,mode=0700,uid=1000,gid=1000 0 0 >> diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs >> index c1fd2834..b6e505bc 100755 >> --- a/img/app/image/etc/mdev/virtiofs >> +++ b/img/app/image/etc/mdev/virtiofs >> @@ -7,6 +7,6 @@ background { >> # virtiofs filesystems, so we only supported a single, hardcoded >> # filesystem tag for now. >> if { mkdir -p /run/virtiofs/virtiofs0 } >> - if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 } >> + if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 } >> /etc/mdev/listen virtiofs0 >> } >> diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run >> index 0ba1f374..997897de 100755 >> --- a/img/app/image/etc/s6-rc/app/run >> +++ b/img/app/image/etc/s6-rc/app/run >> @@ -17,7 +17,7 @@ foreground { >> if { modprobe loop } >> if { >> backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset } >> - mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt >> + mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt >> } >> s6-setuidgid user >> export APPIMAGE /run/virtiofs/virtiofs0/config/run >> @@ -42,7 +42,7 @@ foreground { >> nix { >> if { >> mount -t overlay >> - -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store >> + -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store >> store /nix/store >> } >> >> diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb >> index e4d265f0..cedce9ae 100755 >> --- a/img/app/scripts/start-virtiofsd.elb >> +++ b/img/app/scripts/start-virtiofsd.elb >> @@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock >> background { >> if { mkdir -p build/fs } >> unshare -rUm >> - if { mount -t tmpfs fs build/fs } >> + if { mount -t tmpfs -o nosuid,nodev fs build/fs } >> if { mkdir build/fs/config } >> if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config } >> importas -SsD virtiofsd VIRTIOFSD >> diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update >> index facf7f52..b397f238 100755 >> --- a/vm/app/systemd-sysupdate/download-update >> +++ b/vm/app/systemd-sysupdate/download-update >> @@ -5,7 +5,7 @@ >> export LC_ALL C >> export LANGUAGE C >> unshare -mr >> -if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } >> +if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } > > Feel free to add noexec and nosymfollow to this. Unless I am very > much mistaken, the updater should be fine with both. > >> backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } >> # Not a useless use of cat: if there are NUL bytes in the URL >> # busybox's awk might misbehave. >> diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab >> index a0b62fa5..4c240544 100644 >> --- a/vm/sys/net/image/etc/fstab >> +++ b/vm/sys/net/image/etc/fstab >> @@ -1,8 +1,8 @@ >> # SPDX-License-Identifier: CC0-1.0 >> -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross >> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross >> # SPDX-FileCopyrightText: 2025 Yureka Lilian >> -proc /proc proc defaults 0 0 >> -devpts /dev/pts devpts gid=5,mode=620 0 0 >> -tmpfs /dev/shm tmpfs defaults 0 0 >> -sysfs /sys sysfs defaults 0 0 >> -bpffs /sys/fs/bpf bpf defaults 0 0 >> +proc /proc proc nosuid,nodev,noexec 0 0 >> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 >> +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 >> +sysfs /sys sysfs nosuid,nodev,noexec 0 0 >> +bpffs /sys/fs/bpf bpf nosuid,nodev,noexec,mode=700 0 0 >> >> base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f > > There might be additional improvements that can be made, but > those can come later, so: > > Acked-by: Demi Marie Obenour > > with or without the suggested changes. Alright, I'll test and commit this with the updater changes, and follow up separately on the others.