From 329fc8587c18698a6e7295f2c12d7d588a34c7f7 Mon Sep 17 00:00:00 2001 From: Moe-hacker Date: Sat, 23 Nov 2024 04:43:24 +0000 Subject: [PATCH] --ro-root will make proc and sysfs read-only now --- src/chroot.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/chroot.c b/src/chroot.c index a5a461d..5c738d4 100644 --- a/src/chroot.c +++ b/src/chroot.c @@ -86,8 +86,13 @@ static void init_container(struct RURI_CONTAINER *_Nonnull container) mkdir("/sys", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mkdir("/proc", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); mkdir("/dev", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP); - mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL); - mount("sysfs", "/sys", "sysfs", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL); + if (container->ro_root) { + mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_RDONLY, NULL); + mount("sysfs", "/sys", "sysfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_RDONLY, NULL); + } else { + mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL); + mount("sysfs", "/sys", "sysfs", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL); + } mount("tmpfs", "/dev", "tmpfs", MS_NOSUID, "size=65536k,mode=755"); // Continue mounting some other directories in /dev. mkdir("/dev/pts", S_IRUSR | S_IWUSR | S_IROTH | S_IWOTH | S_IRGRP | S_IWGRP);