From e8536954c58f66eb4ab47596c6b39f12f20da42a Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sat, 10 Apr 2010 21:46:51 +0200 Subject: [PATCH 1/1] mount-setup: disable device, execution, suid on device file systems --- mount-setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mount-setup.c b/mount-setup.c index 8cb77669f..8ad37f860 100644 --- a/mount-setup.c +++ b/mount-setup.c @@ -43,8 +43,8 @@ enum { static const char *table[] = { "proc", "/proc", "proc", NULL, "sysfs", "/sys", "sysfs", NULL, - "devtmps", "/dev", "devtmpfs", "mode=755", - "tmpfs", "/dev/shm", "tmpfs", "mode=1777", + "devtmps", "/dev", "devtmpfs", "mode=755,noexec,nosuid", + "tmpfs", "/dev/shm", "tmpfs", "mode=1777,nodev,noexec,nosuid", "devpts", "/dev/pts", "devpts", NULL, "cgroup", "/cgroup/debug", "cgroup", "debug", "debugfs", "/sys/kernel/debug", "debugfs", NULL, -- 2.30.2