diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-08-01 23:54:33 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-01 23:56:28 +0900 |
| commit | 3b8a3d3b004695d79745c34821b33cfbe41048a9 (patch) | |
| tree | bdc3ba42fa32e2d4c2c48305e8f381f40bc4c891 /test/sandbox/case/pd.nix | |
| parent | c5d24979f5d6095116d66beb544aa382816183f9 (diff) | |
app: remount root readonly
This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'test/sandbox/case/pd.nix')
| -rw-r--r-- | test/sandbox/case/pd.nix | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/test/sandbox/case/pd.nix b/test/sandbox/case/pd.nix index 950afdfe..2b87290c 100644 --- a/test/sandbox/case/pd.nix +++ b/test/sandbox/case/pd.nix @@ -138,7 +138,7 @@ } null; mount = [ - (ent "/sysroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000000,gid=1000000") + (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000000,gid=1000000") (ent "/bin" "/bin" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") (ent "/home" "/home" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") (ent "/lib64" "/lib64" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") |