From 19da0a206827765e53864ea1639a8e9d8f8be767 Mon Sep 17 00:00:00 2001
From: Gao feng <omarapazanadi@gmail.com>
Date: Thu, 29 Oct 2015 10:00:59 +0800
Subject: [PATCH] add mount option for filesystems

Signed-off-by: Gao feng <omarapazanadi@gmail.com>
---
 src/container.c |  8 ++++----
 src/init.c      | 10 +++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/container.c b/src/container.c
index 1aad90b..3eaabeb 100644
--- a/src/container.c
+++ b/src/container.c
@@ -102,9 +102,9 @@ static int container_setup_mount(struct hyper_container *container)
 	hyper_mkdir("/sys");
 	hyper_mkdir("/dev");
 
-	if (mount("proc", "/proc", "proc", 0, NULL) < 0 ||
-	    mount("sysfs", "/sys", "sysfs", 0, NULL) < 0 ||
-	    mount("devtmpfs", "/dev", "devtmpfs", 0, NULL) < 0) {
+	if (mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0 ||
+	    mount("sysfs", "/sys", "sysfs", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0 ||
+	    mount("devtmpfs", "/dev", "devtmpfs", MS_NOSUID, NULL) < 0) {
 		perror("mount basic filesystem for container failed");
 		return -1;
 	}
@@ -114,7 +114,7 @@ static int container_setup_mount(struct hyper_container *container)
 		return -1;
 	}
 
-	if (mount("tmpfs", "/dev/shm/", "tmpfs", 0, NULL) < 0) {
+	if (mount("tmpfs", "/dev/shm/", "tmpfs", MS_NOSUID| MS_NODEV, NULL) < 0) {
 		perror("mount shm failed");
 		return -1;
 	}
diff --git a/src/init.c b/src/init.c
index 58c2ecb..00b1d8b 100644
--- a/src/init.c
+++ b/src/init.c
@@ -319,7 +319,7 @@ static int hyper_pod_init(void *data)
 		goto fail;
 	}
 
-	if (mount("proc", "/proc", "proc", 0, NULL) < 0) {
+	if (mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0) {
 		perror("mount proc filesystem failed\n");
 		goto fail;
 	}
@@ -1204,19 +1204,19 @@ int main(int argc, char *argv[])
 		return -1;
 	}
 
-	if (mount("proc", "/proc", "proc", 0, NULL) == -1) {
+	if (mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) == -1) {
 		perror("mount proc failed");
 		return -1;
 	}
 
 	hyper_print_uptime();
 
-	if (mount("sysfs", "/sys", "sysfs", 0, NULL) == -1) {
+	if (mount("sysfs", "/sys", "sysfs", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) == -1) {
 		perror("mount sysfs failed");
 		return -1;
 	}
 
-	if (mount("dev", "/dev", "devtmpfs", 0, NULL) == -1) {
+	if (mount("dev", "/dev", "devtmpfs", MS_NOSUID, NULL) == -1) {
 		perror("mount sysfs failed");
 		return -1;
 	}
@@ -1226,7 +1226,7 @@ int main(int argc, char *argv[])
 		return -1;
 	}
 
-	if (mount("devpts", "/dev/pts", "devpts", 0, NULL) == -1) {
+	if (mount("devpts", "/dev/pts", "devpts", MS_NOSUID| MS_NOEXEC, NULL) == -1) {
 		perror("mount devpts failed");
 		return -1;
 	}