mount procfs readonly to prevent breakout

src/bin/izoli.rs

@@ -42,6 +42,7 @@ fn main() {
                 Mount::new("/lib64", "/lib64", true, false),
                 Mount::new("/usr/lib", "/usr/lib", true, false),
                 Mount::new("/usr/lib64", "/usr/lib64", true, false),
+                Mount::new("/etc", "/etc", true, true),
             ],
         },
     );

src/izolibox.rs

@@ -112,7 +112,7 @@ impl IzoliBox {
 
         let mounts = [
             ("tmp", Some("tmpfs"), MsFlags::empty()),
-            ("proc", Some("proc"), MsFlags::empty()),
+            ("proc", Some("proc"), MsFlags::MS_RDONLY),
         ];
 
         for (target, source, flags) in mounts.iter() {