colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #193469 from minijackson/mount-options-stage-1

Browse Source 
nixos/stage-1: follow mount options
This commit is contained in:
Ryan Lahfa 2023-05-05 17:05:48 +02:00 committed by GitHub
commit 275a6e3d8d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
nixos/modules/system/boot/stage-1-init.sh
View File

@ -410,6 +410,11 @@ mountFS() {
n=$((n + 1))
done
# For bind mounts, busybox has a tendency to ignore options, which can be a
# security issue (e.g. "nosuid"). Remounting the partition seems to fix the
# issue.
mount "/mnt-root$mountPoint" -o "remount,$optionsPrefixed"
[ "$mountPoint" == "/" ] &&
[ -f "/mnt-root/etc/NIXOS_LUSTRATE" ] &&
lustrateRoot "/mnt-root"

1
nixos/tests/all-tests.nix
View File

@ -206,6 +206,7 @@ in {
dovecot = handleTest ./dovecot.nix {};
drbd = handleTest ./drbd.nix {};
earlyoom = handleTestOn ["x86_64-linux"] ./earlyoom.nix {};
early-mount-options = handleTest ./early-mount-options.nix {};
ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
ecryptfs = handleTest ./ecryptfs.nix {};

19
nixos/tests/early-mount-options.nix Normal file
View File

@ -0,0 +1,19 @@
# Test for https://github.com/NixOS/nixpkgs/pull/193469
import ./make-test-python.nix {
name = "early-mount-options";
nodes.machine = {
virtualisation.fileSystems."/var" = {
options = [ "bind" "nosuid" "nodev" "noexec" ];
device = "/var";
};
};
testScript = ''
machine.wait_for_unit("multi-user.target")
var_mount_info = machine.succeed("findmnt /var -n -o OPTIONS")
options = var_mount_info.strip().split(",")
assert "nosuid" in options and "nodev" in options and "noexec" in options
'';
}