From 3be9fcd1a4d05576ef5dbe7c0446132feee24060 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Wed, 10 Apr 2024 22:52:56 +0200 Subject: Mounting /proc with hidepid=2 option. Signed-off-by: Daniel Baumann --- .../patches/progress-linux/0002-proc-hidepid.patch | 27 ++++++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 28 insertions(+) create mode 100644 debian/patches/progress-linux/0002-proc-hidepid.patch diff --git a/debian/patches/progress-linux/0002-proc-hidepid.patch b/debian/patches/progress-linux/0002-proc-hidepid.patch new file mode 100644 index 0000000..52de2bd --- /dev/null +++ b/debian/patches/progress-linux/0002-proc-hidepid.patch @@ -0,0 +1,27 @@ +Author: Daniel Baumann +Description: Mounting /proc with hidepid=2 option. + +diff -Naurp systemd.orig/src/nspawn/nspawn-mount.c systemd/src/nspawn/nspawn-mount.c +--- systemd.orig/src/nspawn/nspawn-mount.c ++++ systemd/src/nspawn/nspawn-mount.c +@@ -542,7 +542,7 @@ int mount_all(const char *dest, + + static const MountPoint mount_table[] = { + /* First we list inner child mounts (i.e. mounts applied *after* entering user namespacing) */ +- { "proc", "/proc", "proc", NULL, PROC_DEFAULT_MOUNT_FLAGS, ++ { "proc", "/proc", "proc", "hidepid=2", PROC_DEFAULT_MOUNT_FLAGS, + MOUNT_FATAL|MOUNT_IN_USERNS|MOUNT_MKDIR|MOUNT_FOLLOW_SYMLINKS }, /* we follow symlinks here since not following them requires /proc/ already being mounted, which we don't have here. */ + + { "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND, +diff -Naurp systemd.orig/src/shared/mount-setup.c systemd/src/shared/mount-setup.c +--- systemd.orig/src/shared/mount-setup.c ++++ systemd/src/shared/mount-setup.c +@@ -77,7 +77,7 @@ static bool check_recursiveprot_supporte + } + + static const MountPoint mount_table[] = { +- { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, ++ { "proc", "/proc", "proc", "hidepid=2", MS_NOSUID|MS_NOEXEC|MS_NODEV, + NULL, MNT_FATAL|MNT_IN_CONTAINER|MNT_FOLLOW_SYMLINK }, + { "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, + NULL, MNT_FATAL|MNT_IN_CONTAINER }, diff --git a/debian/patches/series b/debian/patches/series index 6e89346..de2fa2c 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -8,3 +8,4 @@ debian/Downgrade-a-couple-of-warnings-to-debug.patch debian/Skip-flaky-test_resolved_domain_restricted_dns-in-network.patch debian/localectl-disable-keymap-support.patch progress-linux/0001-agetty-nohostname.patch +progress-linux/0002-proc-hidepid.patch -- cgit v1.2.3