From 3b8a3d3b004695d79745c34821b33cfbe41048a9 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Fri, 1 Aug 2025 23:54:33 +0900 Subject: app: remount root readonly This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container. Signed-off-by: Ophestra --- test/sandbox/case/device.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'test/sandbox/case/device.nix') diff --git a/test/sandbox/case/device.nix b/test/sandbox/case/device.nix index f5bdaa71..ded60aae 100644 --- a/test/sandbox/case/device.nix +++ b/test/sandbox/case/device.nix @@ -200,7 +200,7 @@ in } null; mount = [ - (ent "/sysroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000004,gid=1000004") + (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000004,gid=1000004") (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw") (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=1000004,gid=1000004") (ent "/" "/dev" "rw,nosuid" "devtmpfs" "devtmpfs" ignore) -- cgit v1.3.1