Files
s390-tools/rust/pvebc/95sel-ebc/boot-mount.sh
Finn Callies 17007ab121 95sel-ebc: Harden boot mount service
Pin the supported filesystem type to ext4 to prevent the risk of auto fs
parsing bugs. Additionally mount the boot partition with more
restrictive options.

Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2026-07-20 15:25:58 +02:00

32 lines
618 B
Bash

#!/bin/bash
# SPDX-License-Identifier: MIT
#
# Copyright IBM Corp.
set -eu
mntp="/boot"
block_dev="$(blkid -L boot)"
if [[ -z "${block_dev}" ]]; then
echo "Unable to find partition with label boot"
exit 1
elif [[ ! -b "${block_dev}" ]]; then
echo "Unable to find block device ${block_dev}"
exit 1
else
echo "Found block device ${block_dev}"
fi
if [[ ! -d "${mntp}" ]]; then
echo "Mountpoint ${mntp} does not exist, creating..."
mkdir "${mntp}"
else
echo "Mountpoint ${mntp} exists"
fi
echo "Mounting ${block_dev} to ${mntp}"
mount -t ext4 --options ro,nodev,nosuid,noexec "${block_dev}" "${mntp}"
exit 0