Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Patrick Schleizer 2023-10-22 14:29:02 -04:00
parent 245fad0986
commit 6198ae317c
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
usr/bin/remount-secure
View File

@ -151,45 +151,46 @@ _boot() {
} }
_run() { _run() {
mount_folder="$NEWROOT/run" mount_folder="/run"
## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html ## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html
intended_mount_options="nosuid,nodev${noexec_maybe}" intended_mount_options="nosuid,nodev${noexec_maybe}"
remount_secure "$@" remount_secure "$@"
} }
_dev() { _dev() {
mount_folder="$NEWROOT/dev" mount_folder="/dev"
intended_mount_options="nosuid,${noexec_maybe}" intended_mount_options="nosuid,${noexec_maybe}"
remount_secure "$@" remount_secure "$@"
} }
_dev_shm() { _dev_shm() {
mount_folder="$NEWROOT/dev/shm" mount_folder="/dev/shm"
intended_mount_options="nosuid,nodev${noexec_maybe}" intended_mount_options="nosuid,nodev${noexec_maybe}"
remount_secure "$@" remount_secure "$@"
} }
_tmp() { _tmp() {
mount_folder="$NEWROOT/tmp" mount_folder="/tmp"
intended_mount_options="nosuid,nodev${noexec_maybe}" intended_mount_options="nosuid,nodev${noexec_maybe}"
remount_secure "$@" remount_secure "$@"
} }
_var() { _var() {
mount_folder="$NEWROOT/var" mount_folder="/var"
## TODO: nodev? noexec? ## TODO: nodev? noexec?
intended_mount_options="nosuid" intended_mount_options="nosuid"
remount_secure "$@" remount_secure "$@"
} }
_var_tmp() { _var_tmp() {
mount_folder="$NEWROOT/var/tmp" mount_folder="/var/tmp"
intended_mount_options="nosuid,nodev${noexec_maybe}" intended_mount_options="nosuid,nodev${noexec_maybe}"
remount_secure "$@" remount_secure "$@"
} }
## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25 ## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25
_lib() { _lib() {
## TODO: NEWROOT?
mount_folder="$NEWROOT/lib" mount_folder="$NEWROOT/lib"
## Not using noexec on /lib. ## Not using noexec on /lib.
intended_mount_options="nosuid,nodev" intended_mount_options="nosuid,nodev"
@ -216,13 +217,15 @@ main() {
parse_options "$@" parse_options "$@"
_boot "$@" _boot "$@"
#_run "$@" _run "$@"
## TODO: ? ## TODO: ?
#_dev "$@" #_dev "$@"
#_dev_shm "$@" _dev_shm "$@"
#_tmp "$@" _tmp "$@"
## TODO: ?
#_var "$@" #_var "$@"
#_var_tmp "$@" #_var_tmp "$@"