From 3b8a3d3b004695d79745c34821b33cfbe41048a9 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Fri, 1 Aug 2025 23:54:33 +0900 Subject: app: remount root readonly This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container. Signed-off-by: Ophestra --- test/sandbox/case/pd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'test/sandbox/case/pd.nix') diff --git a/test/sandbox/case/pd.nix b/test/sandbox/case/pd.nix index 950afdfe..2b87290c 100644 --- a/test/sandbox/case/pd.nix +++ b/test/sandbox/case/pd.nix @@ -138,7 +138,7 @@ } null; mount = [ - (ent "/sysroot" "/" "rw,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000000,gid=1000000") + (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000000,gid=1000000") (ent "/bin" "/bin" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") (ent "/home" "/home" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") (ent "/lib64" "/lib64" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") -- cgit v1.3.1