Change fmask value in /etc/fstab

[Tiagoquix]

Since #4506 we set fmask=0077,dmask=0077 by default to prevent bootctl being angry because the random-seed is world-acessible.

However, fmask=0177 probably makes more sense (dmask is fine not to change), and is also what systemd uses.

See:

• https://wiki.archlinux.org/title/Talk:EFI_system_partition#Mountpoint_umask
  • [3] from that: https://github.com/systemd/systemd/blob/32ac7af7888bc46f91c1af7d9ba05fec929b31ad/src/shared/dissect-image.c#L2366

[Tiagoquix]

CC @0xdeadd

[h8d13]

This looks more correct and good job with the digging.

Also notice: nosuid,noexec,nosymfollow options

[Tiagoquix]

The fstab article uses nodev,nosuid,noexec in its examples: https://wiki.archlinux.org/title/Fstab

I am not sure about the nosymfolllow option, though. (I have never seen that one.)

[h8d13]

https://github.com/systemd/systemd/blob/32ac7af7888bc46f91c1af7d9ba05fec929b31ad/src/shared/dissect-image.c#L2361

4 lines above your link

[Tiagoquix]

Ah, interesting. Thanks for the info. That could be added to archinstall as well.

There's also this:

    case PARTITION_TMP:
           flags |= MS_NOSUID;
           break;

Which I assume would be for /tmp, but /tmp itself is not in /etc/fstab.