ramlog: harden the zram mounting

this is to improve the score of /var/log for FILE-6374 in Lynis audit
armbian · Apr 17, 2024 · 4df3bdd · 4df3bdd
1 parent 5e008a8
commit 4df3bdd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/bsp/common/usr/lib/armbian/armbian-ramlog b/packages/bsp/common/usr/lib/armbian/armbian-ramlog
@@ -126,7 +126,7 @@ case "$1" in
  case $LOG_TYPE in
  zram)
  echo -e "Mounting $rd as $RAM_LOG \c" | $LOG_OUTPUT
- mount -o discard $rd $RAM_LOG 2>&1 | $LOG_OUTPUT
+ mount -o discard,nosuid,noexec,nodev $rd $RAM_LOG 2>&1 | $LOG_OUTPUT
  ;;
  tmpfs)
  echo -e "Setting up $RAM_LOG as tmpfs \c" | $LOG_OUTPUT