Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-04-26 14:39:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Patrick Schleizer 2023-10-22 15:05:33 -04:00
parent f440209738
commit eb90d38d8c
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 4 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
usr/bin/remount-secure
View File

@ -170,13 +170,13 @@ _dev_shm() {
} }
_tmp() { _tmp() {
mount_folder="/tmp" mount_folder="$NEWROOT/tmp"
intended_mount_options="nosuid,nodev${noexec_maybe}" intended_mount_options="nosuid,nodev${noexec_maybe}"
remount_secure "$@" remount_secure "$@"
} }
_var() { _var() {
mount_folder="/var" mount_folder="$NEWROOT/var"
## TODO: nodev? noexec? ## TODO: nodev? noexec?
intended_mount_options="nosuid" intended_mount_options="nosuid"
remount_secure "$@" remount_secure "$@"
@ -189,20 +189,13 @@ _var_tmp() {
} }
_var_log() { _var_log() {
mount_folder="/var/log" mount_folder="$NEWROOT/var/log"
intended_mount_options="nosuid,nodev,noexec"
remount_secure "$@"
}
_var_log_audit() {
mount_folder="/var/log/audit"
intended_mount_options="nosuid,nodev,noexec" intended_mount_options="nosuid,nodev,noexec"
remount_secure "$@" remount_secure "$@"
} }
## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25 ## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707/25
_lib() { _lib() {
## TODO: NEWROOT?
mount_folder="$NEWROOT/lib" mount_folder="$NEWROOT/lib"
## Not using noexec on /lib. ## Not using noexec on /lib.
intended_mount_options="nosuid,nodev" intended_mount_options="nosuid,nodev"
@ -240,10 +233,7 @@ main() {
#_var #_var
_var_tmp _var_tmp
_var_log
## TODO: ?
#_var_log
#_var_log_audit
## TODO: broken? ## TODO: broken?
#_lib #_lib