Fixed a bug that caused "dev" and temporary directories to be inaccessible if Landlock is enabled

Signed-off-by: ChrysoliteAzalea <charming.flurry@yandex.ru>

Author: ChrysoliteAzalea

bubblewrap.c

@@ -1112,6 +1112,8 @@ privileged_op (int         privileged_op_socket,
 
     case PRIV_SEP_OP_PROC_MOUNT:
       {
+        if (mount ("proc", arg1, "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL) != 0)
+          die_with_error ("Can't mount proc on %s", arg1);
         if (opt_landlock_ruleset_fd>-1)
           {
             int exposed_fd = open(arg1,O_PATH | O_CLOEXEC);
@@ -1120,15 +1122,15 @@ privileged_op (int         privileged_op_socket,
             add_execute_rule(opt_landlock_ruleset_fd,exposed_fd);
             close(exposed_fd);
           }
-        if (mount ("proc", arg1, "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL) != 0)
-          die_with_error ("Can't mount proc on %s", arg1);
         break;
       }
 
     case PRIV_SEP_OP_TMPFS_MOUNT:
       {
         cleanup_free char *mode = xasprintf ("mode=%#o", perms);
         cleanup_free char *opt = label_mount (mode, opt_file_label);
+        if (mount ("tmpfs", arg1, "tmpfs", MS_NOSUID | MS_NODEV, opt) != 0)
+          die_with_error ("Can't mount tmpfs on %s", arg1);
         if (opt_landlock_ruleset_fd>-1)
           {
             int exposed_fd = open(arg1,O_PATH | O_CLOEXEC);
@@ -1137,26 +1139,26 @@ privileged_op (int         privileged_op_socket,
             add_execute_rule(opt_landlock_ruleset_fd,exposed_fd);
             close(exposed_fd);
           }
-        if (mount ("tmpfs", arg1, "tmpfs", MS_NOSUID | MS_NODEV, opt) != 0)
-          die_with_error ("Can't mount tmpfs on %s", arg1);
         break;
       }
 
     case PRIV_SEP_OP_DEVPTS_MOUNT:
+      if (mount ("devpts", arg1, "devpts", MS_NOSUID | MS_NOEXEC,
+                 "newinstance,ptmxmode=0666,mode=620") != 0)
+        die_with_error ("Can't mount devpts on %s", arg1);
       if (opt_landlock_ruleset_fd>-1)
         {
           int exposed_fd = open(arg1,O_PATH | O_CLOEXEC);
           add_read_access_rule(opt_landlock_ruleset_fd,exposed_fd);
-          add_write_access_rule(opt_landlock_ruleset_fd,exposed_fd,1);
+          add_write_access_rule(opt_landlock_ruleset_fd,exposed_fd,0);
           add_execute_rule(opt_landlock_ruleset_fd,exposed_fd);
           close(exposed_fd);
         }
-      if (mount ("devpts", arg1, "devpts", MS_NOSUID | MS_NOEXEC,
-                 "newinstance,ptmxmode=0666,mode=620") != 0)
-        die_with_error ("Can't mount devpts on %s", arg1);
       break;
 
     case PRIV_SEP_OP_MQUEUE_MOUNT:
+      if (mount ("mqueue", arg1, "mqueue", 0, NULL) != 0)
+        die_with_error ("Can't mount mqueue on %s", arg1);
       if (opt_landlock_ruleset_fd>-1)
         {
           int exposed_fd = open(arg1,O_PATH | O_CLOEXEC);
@@ -1165,8 +1167,6 @@ privileged_op (int         privileged_op_socket,
           add_execute_rule(opt_landlock_ruleset_fd,exposed_fd);
           close(exposed_fd);
         }
-      if (mount ("mqueue", arg1, "mqueue", 0, NULL) != 0)
-        die_with_error ("Can't mount mqueue on %s", arg1);
       break;
 
     case PRIV_SEP_OP_SET_HOSTNAME: