Use the same options for proc and sysfs as Gentoo/OpenRC uses

defaults/initrd.scripts

@@ -210,7 +210,7 @@ cache_cd_contents() {
 }
 
 mount_sysfs() {
-	mount -t sysfs /sys /sys >/dev/null 2>&1
+	mount -t sysfs sysfs /sys -o noexec,nosuid,nodev >/dev/null 2>&1
 	ret=$?
 	[ ${ret} -eq 0 ] || bad_msg "Failed to mount /sys!"
 }

defaults/linuxrc

@@ -20,7 +20,7 @@ then
 	exit 1
 fi
 
-mount -t proc proc /proc >/dev/null 2>&1
+mount -t proc -o noexec,nosuid,nodev proc /proc >/dev/null 2>&1
 mount -o remount,rw / >/dev/null 2>&1
 
 # Set up symlinks