jail: more strict mount options for /tmp/resolv.conf.d/

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

diff --git a/jail/jail.c b/jail/jail.c
index 9b8d1a91b2152b7a21031349f55962727a0d5a99..eb976cb113b1cc9e5ed8425f66d883893f4df5a9 100644 (file)
--- a/jail/jail.c
+++ b/jail/jail.c
@@ -96,11 +96,12 @@ static int mkdir_p(char *dir, mode_t mask)
        return ret;
 }
 
-static int _mount_bind(const char *root, const char *path, const char *target, int readonly, int error)
+static int _mount_bind(const char *root, const char *path, const char *target, int readonly, int strict, int error)
 {
        struct stat s;
        char new[PATH_MAX];
        int fd;
+       int remount_flags = MS_BIND | MS_REMOUNT;
 
        if (stat(path, &s)) {
                ERROR("stat(%s) failed: %m\n", path);
@@ -127,18 +128,26 @@ static int _mount_bind(const char *root, const char *path, const char *target, i
                return -1;
        }
 
-       if (readonly && mount(NULL, new, NULL, MS_BIND | MS_REMOUNT | MS_RDONLY, NULL)) {
-               ERROR("failed to remount ro %s: %m\n", new);
+       if (readonly)
+               remount_flags |= MS_RDONLY;
+
+       if (strict)
+               remount_flags |= MS_NOEXEC | MS_NOSUID | MS_NODEV;
+
+       if ((strict || readonly) && mount(NULL, new, NULL, remount_flags, NULL)) {
+               ERROR("failed to remount (%s%s%s) %s: %m\n", readonly?"ro":"rw",
+                     (readonly && strict)?", ":"", strict?"strict":"", new);
                return -1;
        }
 
-       DEBUG("mount -B %s %s (%s)\n", path, new, readonly?"ro":"rw");
+       DEBUG("mount -B %s %s (%s%s%s)\n", path, new,
+             readonly?"ro":"rw", (readonly && strict)?", ":"", strict?"strict":"");
 
        return 0;
 }
 
 int mount_bind(const char *root, const char *path, int readonly, int error) {
-       return _mount_bind(root, path, NULL, readonly, error);
+       return _mount_bind(root, path, NULL, readonly, 0, error);
 }
 
 static int build_jail_fs(void)
@@ -175,7 +184,7 @@ static int build_jail_fs(void)
 
                snprintf(hostdir, PATH_MAX, "/tmp/resolv.conf-%s.d", opts.name);
                mkdir_p(hostdir, 0755);
-               _mount_bind(jail_root, hostdir, "/tmp/resolv.conf.d", 1, -1);
+               _mount_bind(jail_root, hostdir, "/tmp/resolv.conf.d", 1, 1, -1);
                snprintf(jailetc, PATH_MAX, "%s/etc", jail_root);
                mkdir_p(jailetc, 0755);
                snprintf(jaillink, PATH_MAX, "%s/etc/resolv.conf", jail_root);