grsecurity forums

by **co2pd** » Mon Apr 07, 2003 7:01 pm

ok, now I know remounts can't be done inside root jails

But they can be done outside a jail. Is there any way I can mount a filesystem in RO and totally forbid, ban, disallow, anbody from remounting it?

thanks
ernesto

by **spender** » Mon Apr 07, 2003 8:17 pm

If you mean keeping anyone from outside the chroot from remounting it, you need to use the ACL system. CAP_SYS_ADMIN covers mounting, so you'll need to remove this (it's enforced in the default policy).

-Brad