Re: [PATCH v2] Core Update 170: Harden mount options of /boot on existing installations

["Peter Müller" <peter.mueller@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1335 bytes --]

Hello *,

additionally, we need to ensure /boot mount options are already written with these flags
into /etc/fstab on new installations. For flash-images, this is already done in C169, but
I have yet to investigate where to change things for the ISO files.

Any hints would be appreciated. :-)

Thanks, and best regards,
Peter Müller


> The second version of this patch uses @ instead of / for sed delimiters,
> which makes the command less hard to read. Since Core Update 170 already
> requires a reboot at this point, the respective directive is omitted.
> 
> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
> ---
>  config/rootfiles/core/170/update.sh | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/config/rootfiles/core/170/update.sh b/config/rootfiles/core/170/update.sh
> index 7dde03060..78a4709bc 100644
> --- a/config/rootfiles/core/170/update.sh
> +++ b/config/rootfiles/core/170/update.sh
> @@ -110,6 +110,9 @@ chown nobody:nobody /var/lib/ipblocklist
>  # Start services
>  /etc/init.d/rc.d/unbound start
>  
> +# Harden mount options of /boot
> +sed -e -i "s@[[:space:]]*\/boot[[:space:]]*auto[[:space:]]*defaults[[:space:]]*@ \/boot    auto defaults,nodev,noexec,nosuid   @g" /etc/fstab
> +
>  # This update needs a reboot...
>  touch /var/run/need_reboot
>