From 17007ab121bd3de7dedd3541d5eb33493cc0fd22 Mon Sep 17 00:00:00 2001
From: Finn Callies <fcallies@linux.ibm.com>
Date: Fri, 3 Jul 2026 09:45:40 +0200
Subject: [PATCH] 95sel-ebc: Harden boot mount service
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pin the supported filesystem type to ext4 to prevent the risk of auto fs
parsing bugs. Additionally mount the boot partition with more
restrictive options.

Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 rust/pvebc/95sel-ebc/boot-mount.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/pvebc/95sel-ebc/boot-mount.sh b/rust/pvebc/95sel-ebc/boot-mount.sh
index adc8bdb8..e46b8dfa 100644
--- a/rust/pvebc/95sel-ebc/boot-mount.sh
+++ b/rust/pvebc/95sel-ebc/boot-mount.sh
@@ -26,6 +26,6 @@ else
 fi
 
 echo "Mounting ${block_dev} to ${mntp}"
-mount --options ro "${block_dev}" "${mntp}"
+mount -t ext4 --options ro,nodev,nosuid,noexec "${block_dev}" "${mntp}"
 
 exit 0