From 3392ce5d606be84c07624e0626b99e410449639f Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Mon, 20 Apr 2015 22:21:51 +0200 Subject: system: Make /gnu/store a read-only bind mount by default. * gnu/system/file-systems.scm (%immutable-store): New variable. (%base-file-systems): Add it. * doc/guix.texi (File Systems): Document it. --- gnu/system/file-systems.scm | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) (limited to 'gnu/system/file-systems.scm') diff --git a/gnu/system/file-systems.scm b/gnu/system/file-systems.scm index 4760821840..db861baed2 100644 --- a/gnu/system/file-systems.scm +++ b/gnu/system/file-systems.scm @@ -1,5 +1,5 @@ ;;; GNU Guix --- Functional package management for GNU -;;; Copyright © 2013, 2014 Ludovic Courtès +;;; Copyright © 2013, 2014, 2015 Ludovic Courtès ;;; ;;; This file is part of GNU Guix. ;;; @@ -19,6 +19,7 @@ (define-module (gnu system file-systems) #:use-module (guix gexp) #:use-module (guix records) + #:use-module (guix store) #:export ( file-system file-system? @@ -37,6 +38,7 @@ (define-module (gnu system file-systems) %shared-memory-file-system %pseudo-terminal-file-system %devtmpfs-file-system + %immutable-store %base-file-systems @@ -139,12 +141,24 @@ (define %shared-memory-file-system (options "size=50%") ;TODO: make size configurable (create-mount-point? #t))) +(define %immutable-store + ;; Read-only store to avoid users or daemons accidentally modifying it. + ;; 'guix-daemon' has provisions to remount it read-write in its own name + ;; space. + (file-system + (device (%store-prefix)) + (mount-point (%store-prefix)) + (type "none") + (check? #f) + (flags '(read-only bind-mount)))) + (define %base-file-systems ;; List of basic file systems to be mounted. Note that /proc and /sys are ;; currently mounted by the initrd. (list %devtmpfs-file-system %pseudo-terminal-file-system - %shared-memory-file-system)) + %shared-memory-file-system + %immutable-store)) -- cgit v1.2.3