X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fnspawn.c;h=f4d63ea26536fe28553678e78cb9fa0e1ac7777f;hp=8ee940c2be59ceb04b0177dc02f2ed614954f9f1;hb=8112e84f657839a056afb411249a627956518b24;hpb=f5c1b9eeb94c112e5dac09fc6a47c571356c30c0

diff --git a/src/nspawn.c b/src/nspawn.c
index 8ee940c2b..f4d63ea26 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -124,17 +124,17 @@ static int mount_all(const char *dest) {
         } MountPoint;
 
         static const MountPoint mount_table[] = {
-                { "/proc",     "/proc",     "bind",      NULL,        MS_BIND, true },
-                { "/proc/sys", "/proc/sys", "bind",      NULL,        MS_BIND, true },                        /* Bind mount first */
-                { "/proc/sys", "/proc/sys", "bind",      NULL,        MS_BIND|MS_RDONLY|MS_REMOUNT, true },   /* Then, make it r/o */
-                { "/sys",      "/sys",      "bind",      NULL,        MS_BIND, true },                        /* Bind mount first */
-                { "/sys",      "/sys",      "bind",      NULL,        MS_BIND|MS_RDONLY|MS_REMOUNT, true },   /* Then, make it r/o */
-                { "tmpfs",     "/dev",      "tmpfs",     "mode=755",  MS_NOSUID, true },
-                { "/dev/pts",  "/dev/pts",  "bind",      NULL,        MS_BIND, true },
-                { "tmpfs",     "/run",      "tmpfs",     "mode=755",  MS_NOSUID|MS_NODEV, true },
+                { "proc",      "/proc",     "proc",  NULL,       MS_NOSUID|MS_NOEXEC|MS_NODEV, true  },
+                { "/proc/sys", "/proc/sys", "bind",  NULL,       MS_BIND, true                       },   /* Bind mount first */
+                { "/proc/sys", "/proc/sys", "bind",  NULL,       MS_BIND|MS_RDONLY|MS_REMOUNT, true  },   /* Then, make it r/o */
+                { "/sys",      "/sys",      "bind",  NULL,       MS_BIND,                      true  },   /* Bind mount first */
+                { "/sys",      "/sys",      "bind",  NULL,       MS_BIND|MS_RDONLY|MS_REMOUNT, true  },   /* Then, make it r/o */
+                { "tmpfs",     "/dev",      "tmpfs", "mode=755", MS_NOSUID,                    true  },
+                { "/dev/pts",  "/dev/pts",  "bind",  NULL,       MS_BIND,                      true  },
+                { "tmpfs",     "/run",      "tmpfs", "mode=755", MS_NOSUID|MS_NODEV,           true  },
 #ifdef HAVE_SELINUX
-                { "/selinux",  "/selinux",  "bind",      NULL,        MS_BIND, false },                       /* Bind mount first */
-                { "/selinux",  "/selinux",  "selinuxfs", NULL,        MS_BIND|MS_RDONLY|MS_REMOUNT, false },  /* Then, make it r/o */
+                { "/sys/fs/selinux", "/sys/fs/selinux", "bind", NULL, MS_BIND,                      false },  /* Bind mount first */
+                { "/sys/fs/selinux", "/sys/fs/selinux", "bind", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, false },  /* Then, make it r/o */
 #endif
         };
 
@@ -314,7 +314,6 @@ static int copy_devnodes(const char *dest, const char *console) {
         }
 
 finish:
-
         umask(u);
 
         return r;
@@ -776,7 +775,7 @@ int main(int argc, char *argv[]) {
                         goto child_fail;
                 }
 
-                umask(0002);
+                umask(0022);
 
                 if (drop_capabilities() < 0)
                         goto child_fail;