[PATCH 1/8] Mount devtmpfs read-only into chroot

[Jan Kiszka <jan.kiszka@siemens.com>]

From: Jan Kiszka <jan.kiszka@siemens.com>

It's too easy to destroy the content of devtmpfs, which is shared with
the host (including privileged container setups), by calling rm -rf on
an output dir that still has devtmpfs mounted.

To achieve write protection for device nodes, we can't mount devtmpfs
directly in read-only mode as that will change all mounts to that mode.
Luckily, doing a read-only bind-mount does the trick.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 meta/classes/dpkg-base.bbclass                   | 2 +-
 meta/recipes-devtools/buildchroot/buildchroot.bb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
index 5eef11b..78709f9 100644
--- a/meta/classes/dpkg-base.bbclass
+++ b/meta/classes/dpkg-base.bbclass
@@ -41,7 +41,7 @@ do_build() {
         if ! grep -q ${BUILDCHROOT_DIR}/isar-apt /proc/mounts; then \
             mount --bind ${DEPLOY_DIR_APT}/${DISTRO} ${BUILDCHROOT_DIR}/isar-apt; \
             mount --bind ${DL_DIR} ${BUILDCHROOT_DIR}/downloads; \
-            mount -t devtmpfs -o mode=0755,nosuid devtmpfs ${BUILDCHROOT_DIR}/dev; \
+            mount --bind -o ro /dev ${BUILDCHROOT_DIR}/dev; \
             mount -t proc none ${BUILDCHROOT_DIR}/proc; \
         fi'
 
diff --git a/meta/recipes-devtools/buildchroot/buildchroot.bb b/meta/recipes-devtools/buildchroot/buildchroot.bb
index 520daf9..1eca035 100644
--- a/meta/recipes-devtools/buildchroot/buildchroot.bb
+++ b/meta/recipes-devtools/buildchroot/buildchroot.bb
@@ -66,7 +66,7 @@ do_build() {
            "${WORKDIR}/multistrap.conf.in" > "${WORKDIR}/multistrap.conf"
 
     sudo mount --bind ${DEPLOY_DIR_APT}/${DISTRO} ${BUILDCHROOT_DIR}/isar-apt
-    sudo mount -t devtmpfs -o mode=0755,nosuid devtmpfs ${BUILDCHROOT_DIR}/dev
+    sudo mount --bind -o ro /dev ${BUILDCHROOT_DIR}/dev
     sudo mount -t proc none ${BUILDCHROOT_DIR}/proc
 
     # Create root filesystem
-- 
2.13.6