Mount container root nosuid

esrlabs · Oct 19, 2023 · 05c4514 · 05c4514
1 parent 3773d44
commit 05c4514
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/northstar-runtime/src/runtime/mount.rs b/northstar-runtime/src/runtime/mount.rs
@@ -267,15 +267,15 @@ fn mount(
         device.display(),
         target.display(),
     );
-    const FLAGS: MountFlags = MountFlags::MS_RDONLY;
+    let flags = MountFlags::MS_RDONLY | MountFlags::MS_NOSUID;
     const FSTYPE: Option<&str> = Some(FS_TYPE);
     let source = Some(&device);
     let data = selinux
         .then_some(())
         .and(selinux_context)
         .map(|context| format!("context={}", context.as_str()));
     let data = data.as_deref();
-    let mount_result = nix::mount::mount(source, target, FSTYPE, FLAGS, data);
+    let mount_result = nix::mount::mount(source, target, FSTYPE, flags, data);
 
     if let Err(ref e) = mount_result {
         warn!("Failed to mount: {}", e);