overlay/mounts: Mount /boot and /boot/efi ro,nodev,nosuid #356
Conversation
Ironically ostree has had support for a `ro` boot for a long time, and only more recently did we land the [sysroot readonly](coreos/coreos-assembler#736). But we never actually went and made `/boot` `ro` for FCOS, so let's do it now. This was actually motivated by someone wanting to "security harden" RHCOS running through a checklist saying certain mounts should be `nodev`. Let's add `nosuid` while we're here.
| set -euo pipefail | ||
| systemctl is-enabled logrotate.service | ||
| echo "ok logrotate" | ||
|
|
||
| validate_not_writable_mount() { | ||
| local mnt=$1 | ||
| shift | ||
| findmnt "${mnt}" -o OPTIONS | grep -q ro | ||
| if test -w "${mnt}"; then | ||
| echo "writable ${mnt}" | ||
| exit 1 | ||
| fi | ||
| echo "ok not writable ${mnt}" | ||
| } | ||
|
|
||
| validate_not_writable_mount /boot | ||
| if test -d /boot/efi; then | ||
| validate_not_writable_mount /boot/efi | ||
| fi |
There was a problem hiding this comment.
should this go in a separate file?
There was a problem hiding this comment.
i.e. a different test and maybe add some text about why we have this test
There was a problem hiding this comment.
But then we end up booting a whole other VM for it.
There was a problem hiding this comment.
(What we really want are nondestructive tests and teach kola to reuse existing VMs for them)
There was a problem hiding this comment.
yeah ok that's a good reason to keep it in the same file. Can we add some text at the top about an RFE for nondestructive tests (open issue somewhere?) and then we can break these out once that is in place,
It would still be nice to have a comment at the top of this particular test you are adding about
# in coreos-boot-mount-generator we mount boot readonly, verify it is readonly.
|
If we mount boot read only we probably need to delete at least: |
Hmm; and have the files leak? We already have |
SGTM |
|
Closing in favor of #659 |
Ironically ostree has had support for a
roboot for a long time,and only more recently did we land the sysroot readonly.
But we never actually went and made
/bootrofor FCOS, so let'sdo it now.
This was actually motivated by someone wanting to "security harden" RHCOS
running through a checklist saying certain mounts should be
nodev.Let's add
nosuidwhile we're here.