diff options
| author | Lennart Poettering <lennart@poettering.net> | 2014-03-18 04:06:54 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2014-03-18 04:48:26 +0100 |
| commit | 679142ce4a8def7da43c4d3b2a02bae8c0d21175 (patch) | |
| tree | e4e2b1b1fda6e1c78073da26f2d12dee2ff3235c | |
| parent | a641dcd9bf05418d6a6c165e1c0cff615b4a0f47 (diff) | |
core: remount /sys/fs/cgroup/ read-only after we mounted all controllers
Given that glibc searches for /dev/shm by just looking for any tmpfs we
should be more careful with providing tmpfs instances arbitrary code
might end up writing to.
| -rw-r--r-- | src/core/mount-setup.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c index c6d3f4bbc..147333a6c 100644 --- a/src/core/mount-setup.c +++ b/src/core/mount-setup.c @@ -338,6 +338,10 @@ int mount_cgroup_controllers(char ***join_controllers) { } } + /* Now that we mounted everything, let's make the tmpfs the + * cgroup file systems are mounted into read-only. */ + mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755"); + return 0; } |