From e29d8a3c24b77b609415013058a909e1f9d64abd Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Wed, 10 Jun 2020 14:32:59 +0100
Subject: [PATCH] runtime: Mount /overrides from mutable sysroot as read-only

This no longer needs to be read/write, because we make all the changes
we are going to make during setup.

Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 src/runtime.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/src/runtime.c b/src/runtime.c
index 009469895..44db0a529 100644
--- a/src/runtime.c
+++ b/src/runtime.c
@@ -1445,18 +1445,10 @@ bind_runtime (PvRuntime *self,
 
   /* In the case where we have a mutable sysroot, we can mount all of
    * /overrides in one go, because we will be keeping it intact as long
-   * as the container is running (along with the rest of mutable_sysroot).
-   *
-   * We have to do this quite early, because we still mount additional
-   * files into /overrides later in setup, and re-mounting /overrides
-   * later on would undo all that.
-   *
-   * For now, we have to mount it read/write, again because we mount
-   * additional, individual files later on. It can become rw when
-   * we stop doing that. */
+   * as the container is running (along with the rest of mutable_sysroot). */
   if (self->mutable_sysroot != NULL)
     flatpak_bwrap_add_args (bwrap,
-                            "--bind", self->overrides, "/overrides",
+                            "--ro-bind", self->overrides, "/overrides",
                             NULL);
 
   flatpak_bwrap_add_args (bwrap,
-- 
GitLab