diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-08-01 23:54:33 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-01 23:56:28 +0900 |
| commit | 3b8a3d3b004695d79745c34821b33cfbe41048a9 (patch) | |
| tree | bdc3ba42fa32e2d4c2c48305e8f381f40bc4c891 /test/sandbox/case/mapuid.nix | |
| parent | c5d24979f5d6095116d66beb544aa382816183f9 (diff) | |
app: remount root readonly
This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'test/sandbox/case/mapuid.nix')
| -rw-r--r-- | test/sandbox/case/mapuid.nix | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/test/sandbox/case/mapuid.nix b/test/sandbox/case/mapuid.nix index 8c6fcdf8..945cfb49 100644 --- a/test/sandbox/case/mapuid.nix +++ b/test/sandbox/case/mapuid.nix @@ -226,7 +226,7 @@ in } null; mount = [ - (ent "/sysroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000003,gid=1000003") + (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000003,gid=1000003") (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw") (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=1000003,gid=1000003") (ent "/" "/dev" "rw,nosuid,nodev,relatime" "tmpfs" "devtmpfs" "rw,mode=755,uid=1000003,gid=1000003") |