Repository navigation
fix(os): harden guest initramfs mounts and dm-verity corruption policy - #1274
Merged
Merged
Conversation
This was referenced Sep 20, 2026
kvinwang
force-pushed
the
fix/guest-initramfs-hardening
branch
from
September 24, 2026 06:42
0ec6281 to
435e78b
Compare
kvinwang
changed the title
The initramfs mounted /proc, /sys, /run and /dev with no options. systemd skips paths that are already mount points and mount --move keeps options, so the guest ran with e.g. a 1777 /run. Use systemd's mount_table options. Open the verity rootfs with --panic-on-corruption instead of the default, which only returns EIO to the reader and keeps the CVM running.
kvinwang
force-pushed
the
fix/guest-initramfs-hardening
branch
from
September 24, 2026 06:52
435e78b to
a999dd5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens the guest initramfs
init. The file lives underos/yocto/, but mkosi installs it as the UKI's/init(os/mkosi/scripts/make-release-artifacts.sh:92), so every shipped image runs it./proc,/sys,/runand/devare now mounted with systemd'smount_tableoptions. systemd skips paths that are already mount points, andmount --movekeeps the options, so before this change the guest ran with a world-writable (1777)/runand withoutnosuid/nodev/noexec.--panic-on-corruption. By default a corrupt block only returnsEIOto the reader and the CVM keeps running. Withpanic=1already on the cmdline, a panic reboots the guest.Checked in containers against busybox 1.37.0 and cryptsetup 2.7.5 (trixie), not in a booted CVM. Changes the UKI measurement.