procd: mount /dev with noexec

[project/procd.git] / initd / early.c

diff --git a/initd/early.c b/initd/early.c
index d69495e3bba3d8fad4dcf109a932a38e4ddff560..87fee657fb323bbee9f6f58d31dd53dff1082b31 100644 (file)
--- a/initd/early.c
+++ b/initd/early.c
@@ -61,7 +61,7 @@ early_mounts(void)
                mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
                mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
                mount("cgroup2", "/sys/fs/cgroup", "cgroup2",  MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RELATIME, "nsdelegate");
-               mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOSUID, "mode=0755,size=512K");
+               mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=0755,size=512K");
                ignore(symlink("/tmp/shm", "/dev/shm"));
                mkdir("/dev/pts", 0755);
                mount("devpts", "/dev/pts", "devpts", MS_NOATIME | MS_NOEXEC | MS_NOSUID, "mode=600");