diff options
author | Topi Miettinen <toiwoton@gmail.com> | 2017-07-25 12:02:19 +0300 |
---|---|---|
committer | Topi Miettinen <toiwoton@gmail.com> | 2017-07-25 12:12:27 +0300 |
commit | 7a324c70bd0db2fc34c9d94edbd4c449c512d558 (patch) | |
tree | a2ed85def0427d84a839752c84f40992c04b98b2 | |
parent | Merge pull request #1397 from Panzerfather/master (diff) | |
download | firejail-7a324c70bd0db2fc34c9d94edbd4c449c512d558.tar.gz firejail-7a324c70bd0db2fc34c9d94edbd4c449c512d558.tar.zst firejail-7a324c70bd0db2fc34c9d94edbd4c449c512d558.zip |
/proc/sys can be nosuid,noexec,nodev
-rw-r--r-- | src/firejail/fs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index c1de53ee5..6695fc6b4 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -515,7 +515,7 @@ void fs_proc_sys_dev_boot(void) { | |||
515 | 515 | ||
516 | // remount /proc/sys readonly | 516 | // remount /proc/sys readonly |
517 | if (mount("/proc/sys", "/proc/sys", NULL, MS_BIND | MS_REC, NULL) < 0 || | 517 | if (mount("/proc/sys", "/proc/sys", NULL, MS_BIND | MS_REC, NULL) < 0 || |
518 | mount(NULL, "/proc/sys", NULL, MS_BIND | MS_REMOUNT | MS_RDONLY | MS_REC, NULL) < 0) | 518 | mount(NULL, "/proc/sys", NULL, MS_BIND | MS_REMOUNT | MS_RDONLY | MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0) |
519 | errExit("mounting /proc/sys"); | 519 | errExit("mounting /proc/sys"); |
520 | fs_logger("read-only /proc/sys"); | 520 | fs_logger("read-only /proc/sys"); |
521 | 521 | ||