make vasile avoid bind mounts, use types instead...this makes our env more secure

1 files changed, 6 insertions, 6 deletions

diff --git a/vasile b/vasile
index 4b869c5..8da0651 100755
--- a/vasile
+++ b/vasile
@@ -86,12 +86,12 @@ envkogaionstart () {
 	# mount ro squashfs chroot + add rw overlayfs layer to enable clean package building
 	mount -t squashfs "$sqfsroot" "$rodir"
 	mount -t overlayfs -o lowerdir="$rodir",upperdir="$rwdir" overlayfs "$overlaydir"
-	mount -o bind /proc "$overlaydir"/proc
-	mount -o bind /sys "$overlaydir"/sys
-	mount -o bind /dev "$overlaydir"/dev
-	mount -o bind /dev/pts "$overlaydir"/dev/pts
-	mount -o bind /dev/shm "$overlaydir"/dev/shm
-	mount -o bind /tmp "$overlaydir"/tmp
+	mount -t proc proc "$overlaydir"/proc
+	mount -t sysfs sysfs "$overlaydir"/sys
+	mount -t devtmpfs -o relatime,size=3055348k,nr_inodes=763837,mode=755 none "$overlaydir"/dev
+	mount -t devpts -o nosuid,noexec,relatime,gid=5,mode=620 none $1/dev/pts "$overlaydir"/dev/pts
+	mount -t tmpfs -o nosuid,nodev none "$overlaydir"/dev/shm
+	mount -t tmpfs -o nosuid,nodev,noexec none  "$overlaydir"/tmp
 }
 
 envkogaionstop () {