From 57eaea9539bb18d683cbac28a6a1b1b09e744944 Mon Sep 17 00:00:00 2001 From: Matthew Heon Date: Wed, 23 Oct 2019 12:08:32 -0400 Subject: Image volumes should not be mounted noexec This matches Docker more closely, but retains the more important protections of nosuid/nodev. Fixes #4318 Signed-off-by: Matthew Heon --- pkg/spec/storage.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'pkg') diff --git a/pkg/spec/storage.go b/pkg/spec/storage.go index a394a19ae..095534589 100644 --- a/pkg/spec/storage.go +++ b/pkg/spec/storage.go @@ -738,13 +738,13 @@ func (config *CreateConfig) getImageVolumes() (map[string]spec.Mount, map[string Destination: cleanDest, Source: TypeTmpfs, Type: TypeTmpfs, - Options: []string{"rprivate", "rw", "nodev"}, + Options: []string{"rprivate", "rw", "nodev", "exec"}, } mounts[vol] = mount } else { // Anonymous volumes have no name. namedVolume := new(libpod.ContainerNamedVolume) - namedVolume.Options = []string{"rprivate", "rw", "nodev"} + namedVolume.Options = []string{"rprivate", "rw", "nodev", "exec"} namedVolume.Dest = cleanDest volumes[vol] = namedVolume } -- cgit v1.2.3-54-g00ecf