From: Daniel Golle <daniel@makrotopia.org>
Date: Sun, 12 Apr 2020 20:39:05 +0000 (+0100)
Subject: jail: mount /sys read-only
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=4953b7c4c03472efeadaa2fe89463e4c6d82533a;p=oweals%2Fprocd.git

jail: mount /sys read-only

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---

diff --git a/jail/jail.c b/jail/jail.c
index 25b847d..052a78e 100644
--- a/jail/jail.c
+++ b/jail/jail.c
@@ -302,7 +302,7 @@ static int build_jail_fs(void)
 	}
 	if (opts.sysfs) {
 		mkdir("/sys", 0755);
-		mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+		mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RDONLY, 0);
 	}
 	if (opts.ronly)
 		mount(NULL, "/", NULL, MS_RDONLY | MS_REMOUNT, 0);