Re: [PATCH 1/8] Mount devtmpfs read-only into chroot

[Alexander Smirnov <asmirnov@ilbers.de>]

On 02/20/2018 09:38 AM, Alexander Smirnov wrote:
> On 02/16/2018 11:52 AM, Jan Kiszka wrote:
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> It's too easy to destroy the content of devtmpfs, which is shared with
>> the host (including privileged container setups), by calling rm -rf on
>> an output dir that still has devtmpfs mounted.
>>
> 
> Just tested this:
> 
> builder@zbook:~/isar/build$ mkdir aaa
> builder@zbook:~/isar/build$ mount -t devtmpfs -o mode=0755,nosuid,ro 
> devtmpfs aaa/
> 
> # Existing host /dev
> [asmirnov@zbook patches]$ sudo rm /dev/ram16
> OK
> 
> # RO mount point
> builder@zbook:~/isar/build$ sudo rm aaa/ram15
> rm: cannot remove ‘aaa/ram15’: Read-only file system
> 
> What I'm doing wrong?
> 

In addition, the following works good:

builder@zbook:~/isar$ mkdir aaa
builder@zbook:~/isar$ sudo mount --bind -o ro /dev aaa/
builder@zbook:~/isar$ sudo rm aaa/ram15

So mount --bind RO doesn't guarantee the RO content.

> BTW: started test build on server to check if problem with wheezy will go.

Build failed, but in the log it seems, that *only* now /dev becomes RO:

I: Extracting automake_1%3a1.15-6_all.deb...
I: Extracting autopoint_0.19.8.1-2_all.deb...
I: Extracting autotools-dev_20161112.1_all.deb...
I: Extracting base-files_9.9+deb9u3_i386.deb...
tar: ./dev: Cannot utime: Read-only file system
tar: ./dev: Cannot change ownership to uid 0, gid 0: Read-only file system
tar: Exiting with failure status due to previous errors
dpkg-deb: error: subprocess tar returned error exit status 2
dpkg -X failed with error code 512
Skipping...

Alex

>> To achieve write protection for device nodes, we can't mount devtmpfs
>> directly in read-only mode as that will change all mounts to that mode.
>> Luckily, doing a read-only bind-mount does the trick.
>>
>> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
>> ---
>>   meta/classes/dpkg-base.bbclass                   | 2 +-
>>   meta/recipes-devtools/buildchroot/buildchroot.bb | 2 +-
>>   2 files changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/meta/classes/dpkg-base.bbclass 
>> b/meta/classes/dpkg-base.bbclass
>> index 5eef11b..78709f9 100644
>> --- a/meta/classes/dpkg-base.bbclass
>> +++ b/meta/classes/dpkg-base.bbclass
>> @@ -41,7 +41,7 @@ do_build() {
>>           if ! grep -q ${BUILDCHROOT_DIR}/isar-apt /proc/mounts; then \
>>               mount --bind ${DEPLOY_DIR_APT}/${DISTRO} 
>> ${BUILDCHROOT_DIR}/isar-apt; \
>>               mount --bind ${DL_DIR} ${BUILDCHROOT_DIR}/downloads; \
>> -            mount -t devtmpfs -o mode=0755,nosuid devtmpfs 
>> ${BUILDCHROOT_DIR}/dev; \
>> +            mount --bind -o ro /dev ${BUILDCHROOT_DIR}/dev; \
>>               mount -t proc none ${BUILDCHROOT_DIR}/proc; \
>>           fi'
>> diff --git a/meta/recipes-devtools/buildchroot/buildchroot.bb 
>> b/meta/recipes-devtools/buildchroot/buildchroot.bb
>> index 520daf9..1eca035 100644
>> --- a/meta/recipes-devtools/buildchroot/buildchroot.bb
>> +++ b/meta/recipes-devtools/buildchroot/buildchroot.bb
>> @@ -66,7 +66,7 @@ do_build() {
>>              "${WORKDIR}/multistrap.conf.in" > 
>> "${WORKDIR}/multistrap.conf"
>>       sudo mount --bind ${DEPLOY_DIR_APT}/${DISTRO} 
>> ${BUILDCHROOT_DIR}/isar-apt
>> -    sudo mount -t devtmpfs -o mode=0755,nosuid devtmpfs 
>> ${BUILDCHROOT_DIR}/dev
>> +    sudo mount --bind -o ro /dev ${BUILDCHROOT_DIR}/dev
>>       sudo mount -t proc none ${BUILDCHROOT_DIR}/proc
>>       # Create root filesystem
>>
> 

-- 
With best regards,
Alexander Smirnov

ilbers GmbH
Baierbrunner Str. 28c
D-81379 Munich
+49 (89) 122 67 24-0
http://ilbers.de/
Commercial register Munich, HRB 214197
General manager: Baurzhan Ismagulov