From f351e951d3744f20e59bcf28de09dd94f8a65693 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 26 Apr 2023 21:23:42 +0200
Subject: [PATCH] update TODO

---
 TODO | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/TODO b/TODO
index ea35f3b7dba..b7d5813f177 100644
--- a/TODO
+++ b/TODO
@@ -129,6 +129,13 @@ Deprecations and removals:
 
 Features:
 
+* mount most file systems with a restrictive uidmap. e.g. mount /usr/ with a
+  uidmap that blocks out anything outside 0…1000 (i.e. system users) and similar.
+
+* mount the root fs with MS_NOSUID by default, and then mount /usr/ without
+  both so that suid executables can only be placed there. Do this already in
+  the initrd. If /usr/ is not split out create a bind mount automatically.
+
 * rework journalctl -M to be based on a machined method that generates a mount
   fd of the relevant journal dirs in the container with uidmapping applied to
   allow the host to read it, while making everything read-only.