From: Yunmi Ha Date: Wed, 26 Jul 2017 06:56:36 +0000 (+0900) Subject: Add "NOEXEC" mount flag for /run X-Git-Tag: accepted/tizen/4.0/unified/20170816.011219^0 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=24c51786fe001424e6e5d31aa4d10cc25964db73;p=platform%2Fupstream%2Fsystemd.git Add "NOEXEC" mount flag for /run Mount flags(nosuid, noexec, nodev) must be set for tmpfs that any app can access. Change-Id: Ib60e8876abe2641a3dde6caab83a60afca017375 Signed-off-by: Yunmi Ha --- diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c index a2a09f7..b3d43d2 100644 --- a/src/core/mount-setup.c +++ b/src/core/mount-setup.c @@ -91,12 +91,12 @@ static const MountPoint mount_table[] = { { "devpts", "/dev/pts", "devpts", "mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC, NULL, MNT_IN_CONTAINER }, #ifdef HAVE_SMACK - { "tmpfs", "/run", "tmpfs", "mode=755,smackfstransmute=System::Run", MS_NOSUID|MS_NODEV|MS_STRICTATIME, + { "tmpfs", "/run", "tmpfs", "mode=755,smackfstransmute=System::Run", MS_NOSUID|MS_NODEV|MS_STRICTATIME|MS_NOEXEC, mac_smack_use, MNT_FATAL }, { "tmpfs", "/sys/fs/cgroup", "tmpfs", "mode=755,smackfsroot=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, mac_smack_use, MNT_IN_CONTAINER }, #else - { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME, + { "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME|MS_NOEXEC, NULL, MNT_FATAL|MNT_IN_CONTAINER }, { "cgroup", "/sys/fs/cgroup", "cgroup2", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, cg_is_unified_wanted, MNT_FATAL|MNT_IN_CONTAINER },