From 3b8a3d3b004695d79745c34821b33cfbe41048a9 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Fri, 1 Aug 2025 23:54:33 +0900 Subject: app: remount root readonly This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container. Signed-off-by: Ophestra --- test/sandbox/case/mapuid.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'test/sandbox/case/mapuid.nix') diff --git a/test/sandbox/case/mapuid.nix b/test/sandbox/case/mapuid.nix index 8c6fcdf8..945cfb49 100644 --- a/test/sandbox/case/mapuid.nix +++ b/test/sandbox/case/mapuid.nix @@ -226,7 +226,7 @@ in } null; mount = [ - (ent "/sysroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000003,gid=1000003") + (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000003,gid=1000003") (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw") (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=1000003,gid=1000003") (ent "/" "/dev" "rw,nosuid,nodev,relatime" "tmpfs" "devtmpfs" "rw,mode=755,uid=1000003,gid=1000003") -- cgit v1.3.1