m/node/kubernetes: mount PVs with noexec on the host
Now that runc always replaces per-mount-point flags when bind-mounting
volumes inside the container, we can mount them with noexec on the host
without affecting workloads. This has some security advantages, as any
executables in volumes are no longer executable from the host.
Change-Id: Id5a8ea8caf702fca58d300fc9e17c21e94ebaf13
Reviewed-on: https://review.monogon.dev/c/monogon/+/3660
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
Tested-by: Jenkins CI
diff --git a/metropolis/node/kubernetes/csi.go b/metropolis/node/kubernetes/csi.go
index f7ff00a..c4e793d 100644
--- a/metropolis/node/kubernetes/csi.go
+++ b/metropolis/node/kubernetes/csi.go
@@ -115,7 +115,7 @@
return nil, status.Errorf(codes.Unavailable, "failed to bind-mount volume: %v", err)
}
- var flags uintptr = unix.MS_REMOUNT | unix.MS_BIND
+ var flags uintptr = unix.MS_REMOUNT | unix.MS_BIND | unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
if req.Readonly {
flags |= unix.MS_RDONLY
}