RomanNum3ral
/
archinstall
mirror of https://github.com/archlinux/archinstall.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: restrict EFI partition permissions with fmask/dmask=0077 

Mount the ESP with fmask=0077 and dmask=0077 to prevent world-readable
files like /efi/loader/random-seed.

Closes #4241
This commit is contained in:
0xdeadd 2026-04-30 17:16:11 -04:00
parent 76629ecc15
commit 98cb263b83
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
archinstall/lib/installer.py
View File

@ -375,7 +375,14 @@ class Installer:
# it would be none if it's btrfs as the subvolumes will have the mountpoints defined # it would be none if it's btrfs as the subvolumes will have the mountpoints defined
if part_mod.mountpoint: if part_mod.mountpoint:
target = self.target / part_mod.relative_mountpoint target = self.target / part_mod.relative_mountpoint
mount(part_mod.dev_path, target, options=part_mod.mount_options) options = list(part_mod.mount_options)
if part_mod.is_efi():
for opt in ('fmask=0077', 'dmask=0077'):
if opt not in options:
options.append(opt)
mount(part_mod.dev_path, target, options=options)
elif part_mod.fs_type == FilesystemType.BTRFS: elif part_mod.fs_type == FilesystemType.BTRFS:
# Only mount BTRFS subvolumes that have mountpoints specified # Only mount BTRFS subvolumes that have mountpoints specified
subvols_with_mountpoints = [sv for sv in part_mod.btrfs_subvols if sv.mountpoint is not None] subvols_with_mountpoints = [sv for sv in part_mod.btrfs_subvols if sv.mountpoint is not None]