evazion afae7aed07 sandbox: fix filesystems not being mounted read-only. ...

* Fix /proc not being mounted read-only.
* Fix other read-only directories not actually being mounted read-only.
  This was because the mount(2) system call ignores mount flags when
  creating a bind mount. The solution is to bind mount the directory
  first, then remount it as read-only second.

Known bug: submounts still don't get mounted as read-only. That is, if
we're mounting /usr as read-only, and /usr has a submount of /usr/local,
then /usr/local won't get mounted as read-only.

2021-11-14 02:07:34 -06:00

15 KiB

Raw Blame History

View Raw