horok/systemd
1
0
Fork 0
Code Activity

Mounting /proc with hidepid=2 option.

Browse source 
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
This commit is contained in:
Daniel Baumann 2025-06-25 18:10:44 +02:00
parent 9806aa3585
commit ae96d061a6
Signed by: daniel.baumann
GPG key ID: BCC918A2ABD66424
2 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

27
debian/patches/progress-linux/0004-proc-hidepid.patch vendored Normal file
View file

@ -0,0 +1,27 @@
Author: Daniel Baumann <daniel.baumann@progress-linux.org>
Description: Mounting /proc with hidepid=2 option.
diff -Naurp systemd.orig/src/nspawn/nspawn-mount.c systemd/src/nspawn/nspawn-mount.c
--- systemd.orig/src/nspawn/nspawn-mount.c
+++ systemd/src/nspawn/nspawn-mount.c
@@ -557,7 +557,7 @@ int mount_all(const char *dest,
static const MountPoint mount_table[] = {
/* First we list inner child mounts (i.e. mounts applied *after* entering user namespacing when we are privileged) */
- { "proc", "/proc", "proc", NULL, PROC_DEFAULT_MOUNT_FLAGS,
+ { "proc", "/proc", "proc", "hidepid=2", PROC_DEFAULT_MOUNT_FLAGS,
MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_MKDIR|MOUNT_FOLLOW_SYMLINKS }, /* we follow symlinks here since not following them requires /proc/ already being mounted, which we don't have here. */
{ "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND,
diff -Naurp systemd.orig/src/shared/mount-setup.c systemd/src/shared/mount-setup.c
--- systemd.orig/src/shared/mount-setup.c
+++ systemd/src/shared/mount-setup.c
@@ -77,7 +77,7 @@ static bool check_recursiveprot_supporte
}
static const MountPoint mount_table[] = {
- { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
+ { "proc", "/proc", "proc", "hidepid=2", MS_NOSUID|MS_NOEXEC|MS_NODEV,
NULL, MNT_FATAL|MNT_IN_CONTAINER|MNT_FOLLOW_SYMLINK },
{ "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
NULL, MNT_FATAL|MNT_IN_CONTAINER },

1
debian/patches/series vendored
View file

@ -1,3 +1,4 @@
progress-linux/0001-agetty-nohostname.patch
progress-linux/0002-logind-noautovts.patch
progress-linux/0003-logind-reservevt.patch
progress-linux/0004-proc-hidepid.patch