0035-mount-setup-Harden-a-bit-the-options-for-certan-moun.patch

From c653d93d8fd13a761b5c7fe642ab95ea2486c880 Mon Sep 17 00:00:00 2001
From: Thiago Macieira <thiago.macieira@intel.com>
Date: Fri, 22 Feb 2019 12:02:54 -0800
Subject: [PATCH 35/38] mount-setup: Harden a bit the options for certan
 mountpoints

/dev/shm has no business with executable files. Since it is
tmpfs, that implies someone is adding the after every boot.
---
 src/shared/mount-setup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c
index bbe1112cc8..25a0f84d62 100644
--- a/src/shared/mount-setup.c
+++ b/src/shared/mount-setup.c
@@ -76,7 +76,7 @@ static const MountPoint mount_table[] = {
         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*",                 MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           mac_smack_use, MNT_FATAL                  },
 #endif
-        { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777",                               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
+        { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777",                               MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_STRICTATIME,
           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
         { "devpts",      "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID),        MS_NOSUID|MS_NOEXEC,
           NULL,          MNT_IN_CONTAINER           },
-- 
2.36.1