ramlog: harden the zram mounting

this is to improve the score of /var/log for FILE-6374 in Lynis audit
ColorfulRhino · Apr 17, 2024 · 4df3bdd · 4df3bdd
1 parent 5e008a8
commit 4df3bdd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/bsp/common/usr/lib/armbian/armbian-ramlog b/packages/bsp/common/usr/lib/armbian/armbian-ramlog
@@ -126,7 +126,7 @@ case "$1" in
 		case $LOG_TYPE in
 			zram)
 				echo -e "Mounting $rd as $RAM_LOG \c" | $LOG_OUTPUT
-				mount -o discard $rd $RAM_LOG 2>&1 | $LOG_OUTPUT
+				mount -o discard,nosuid,noexec,nodev $rd $RAM_LOG 2>&1 | $LOG_OUTPUT
 				;;
 			tmpfs)
 				echo -e "Setting up $RAM_LOG as tmpfs \c" | $LOG_OUTPUT