- mount("proc", "/proc", "proc", MS_NOATIME, 0);
- mount("sysfs", "/sys", "sysfs", MS_NOATIME, 0);
- mount("none", "/sys/fs/cgroup", "cgroup", 0, 0);
- mount("tmpfs", "/dev", "tmpfs", MS_NOATIME, "mode=0755,size=512K");
- mkdir("/dev/shm", 0755);
+ unsigned int oldumask = umask(0);
+
+ mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("cgroup", "/sys/fs/cgroup", "cgroup", MS_NODEV | MS_NOEXEC | MS_NOSUID, 0);
+ mount("tmpfs", "/dev", "tmpfs", MS_NOATIME | MS_NOSUID, "mode=0755,size=512K");
+ ignore(symlink("/tmp/shm", "/dev/shm"));