mnt: added nosuid/nodev/noexec flags to config

Closes #70

diff --git a/config.cc b/config.cc
index 2e2fced72e7a82c8d3c8785036cb10716684839e..8aa9089c94ef47a0aadcbe20b5771c10234a3dec 100644 (file)
--- a/config.cc
+++ b/config.cc
@@ -210,6 +210,9 @@ static bool configParseInternal(nsjconf_t* nsjconf, const nsjail::NsJailConfig&
 
                uintptr_t flags = (!njc.mount(i).rw()) ? MS_RDONLY : 0;
                flags |= njc.mount(i).is_bind() ? (MS_BIND | MS_REC | MS_PRIVATE) : 0;
+               flags |= njc.mount(i).nosuid() ? MS_NOSUID : 0;
+               flags |= njc.mount(i).nodev() ? MS_NODEV : 0;
+               flags |= njc.mount(i).noexec() ? MS_NOEXEC : 0;
                bool is_mandatory = njc.mount(i).mandatory();
                bool is_symlink = njc.mount(i).is_symlink();
                std::string src_content = njc.mount(i).src_content();

diff --git a/config.proto b/config.proto
index 9a25332b613c0b7a3dd77deb5741803d5c951987..e7a59630411e5f133a074eb53b2d25fa752944eb 100644 (file)
--- a/config.proto
+++ b/config.proto
@@ -51,6 +51,12 @@ message MountPt {
     optional bool mandatory = 11 [default = true];
     /* Is it a symlink (instead of real mount point)? */
     optional bool is_symlink = 12 [default = false];
+    /* Is it a nosuid mount */
+    optional bool nosuid = 13 [default = false];
+    /* Is it a nodev mount */
+    optional bool nodev = 14 [default = false];
+    /* Is it a noexec mount */
+    optional bool noexec = 15 [default = false];
 }
 enum RLimit {
     VALUE = 0; /* Use the provided value */

diff --git a/mnt.cc b/mnt.cc
index a019df5eb47262e38edf72a1d323ecc5ed3dbce0..8851d4954eef1cce69a0e0a309a7c4e22f4bbb1a 100644 (file)
--- a/mnt.cc
+++ b/mnt.cc
@@ -248,7 +248,10 @@ static bool remount(const mount_t& mpt) {
            {MS_RELATIME, ST_RELATIME},
        };
 
-       unsigned long new_flags = MS_REMOUNT | MS_BIND | (mpt.flags & MS_RDONLY);
+       const unsigned long per_mountpoint_flags =
+           MS_LAZYTIME | MS_MANDLOCK | MS_NOATIME | MS_NODEV | MS_NODIRATIME | MS_NOEXEC |
+           MS_NOSUID | MS_RELATIME | MS_RDONLY | MS_SYNCHRONOUS;
+       unsigned long new_flags = MS_REMOUNT | MS_BIND | (mpt.flags & per_mountpoint_flags);
        for (const auto& i : mountPairs) {
                if (vfs.f_flag & i.vfs_flag) {
                        new_flags |= i.mount_flag;