From a999dd51f035c004c7749868b544e3b663f3348a Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Wed, 23 Sep 2026 23:51:51 -0700 Subject: [PATCH] fix(os): harden guest initramfs mounts and dm-verity policy The initramfs mounted /proc, /sys, /run and /dev with no options. systemd skips paths that are already mount points and mount --move keeps options, so the guest ran with e.g. a 1777 /run. Use systemd's mount_table options. Open the verity rootfs with --panic-on-corruption instead of the default, which only returns EIO to the reader and keeps the CVM running. --- .../recipes-core/images/dstack-initscript/init | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/os/yocto/layers/meta-dstack/recipes-core/images/dstack-initscript/init b/os/yocto/layers/meta-dstack/recipes-core/images/dstack-initscript/init index 968671f60..eb76e182a 100755 --- a/os/yocto/layers/meta-dstack/recipes-core/images/dstack-initscript/init +++ b/os/yocto/layers/meta-dstack/recipes-core/images/dstack-initscript/init @@ -68,12 +68,13 @@ main() { mkdir -p /proc mkdir -p /sys mkdir -p /run - mount -t proc proc /proc - mount -t sysfs sysfs /sys - mount -t tmpfs tmpfs /run + # systemd keeps these mounts as-is, so apply its options here. + mount -t proc -o nosuid,nodev,noexec proc /proc + mount -t sysfs -o nosuid,nodev,noexec sysfs /sys + mount -t tmpfs -o nosuid,nodev,mode=0755 tmpfs /run mkdir -p /dev - mount -t devtmpfs devtmpfs /dev + mount -t devtmpfs -o nosuid,strictatime,mode=0755 devtmpfs /dev mkdir -p /dev/pts @@ -107,7 +108,7 @@ main() { log "missing dm-verity parameters; refusing to continue" exit 1 fi - veritysetup open "${ROOT_DEV}" rootfs "${ROOT_DEV}" "${ROOT_HASH}" --hash-offset="${DATA_SIZE}" + veritysetup open "${ROOT_DEV}" rootfs "${ROOT_DEV}" "${ROOT_HASH}" --hash-offset="${DATA_SIZE}" --panic-on-corruption log "mounting verified rootfs from /dev/mapper/rootfs" mount -t squashfs /dev/mapper/rootfs ${ROOT_DIR} mount_move_all sys proc dev run