Re: [PATCH 1/8] Mount devtmpfs read-only into chroot

[Jan Kiszka <jan.kiszka@siemens.com>]

On 2018-02-20 07:38, Alexander Smirnov wrote:
> On 02/16/2018 11:52 AM, Jan Kiszka wrote:
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> It's too easy to destroy the content of devtmpfs, which is shared with
>> the host (including privileged container setups), by calling rm -rf on
>> an output dir that still has devtmpfs mounted.
>>
> 
> Just tested this:
> 
> builder@zbook:~/isar/build$ mkdir aaa
> builder@zbook:~/isar/build$ mount -t devtmpfs -o mode=0755,nosuid,ro
> devtmpfs aaa/

I've tried that path first, but it turns all mount points of devtmpfs
into read-only mode - not a good idea...

I think we need to go back to mknod for the rootfs.

Jan

> 
> # Existing host /dev
> [asmirnov@zbook patches]$ sudo rm /dev/ram16
> OK
> 
> # RO mount point
> builder@zbook:~/isar/build$ sudo rm aaa/ram15
> rm: cannot remove ‘aaa/ram15’: Read-only file system
> 
> What I'm doing wrong?
> 
> BTW: started test build on server to check if problem with wheezy will go.
> 
> Alex
> 
>> To achieve write protection for device nodes, we can't mount devtmpfs
>> directly in read-only mode as that will change all mounts to that mode.
>> Luckily, doing a read-only bind-mount does the trick.
>>
>> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
>> ---
>>   meta/classes/dpkg-base.bbclass                   | 2 +-
>>   meta/recipes-devtools/buildchroot/buildchroot.bb | 2 +-
>>   2 files changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/meta/classes/dpkg-base.bbclass
>> b/meta/classes/dpkg-base.bbclass
>> index 5eef11b..78709f9 100644
>> --- a/meta/classes/dpkg-base.bbclass
>> +++ b/meta/classes/dpkg-base.bbclass
>> @@ -41,7 +41,7 @@ do_build() {
>>           if ! grep -q ${BUILDCHROOT_DIR}/isar-apt /proc/mounts; then \
>>               mount --bind ${DEPLOY_DIR_APT}/${DISTRO}
>> ${BUILDCHROOT_DIR}/isar-apt; \
>>               mount --bind ${DL_DIR} ${BUILDCHROOT_DIR}/downloads; \
>> -            mount -t devtmpfs -o mode=0755,nosuid devtmpfs
>> ${BUILDCHROOT_DIR}/dev; \
>> +            mount --bind -o ro /dev ${BUILDCHROOT_DIR}/dev; \
>>               mount -t proc none ${BUILDCHROOT_DIR}/proc; \
>>           fi'
>>   diff --git a/meta/recipes-devtools/buildchroot/buildchroot.bb
>> b/meta/recipes-devtools/buildchroot/buildchroot.bb
>> index 520daf9..1eca035 100644
>> --- a/meta/recipes-devtools/buildchroot/buildchroot.bb
>> +++ b/meta/recipes-devtools/buildchroot/buildchroot.bb
>> @@ -66,7 +66,7 @@ do_build() {
>>              "${WORKDIR}/multistrap.conf.in" >
>> "${WORKDIR}/multistrap.conf"
>>         sudo mount --bind ${DEPLOY_DIR_APT}/${DISTRO}
>> ${BUILDCHROOT_DIR}/isar-apt
>> -    sudo mount -t devtmpfs -o mode=0755,nosuid devtmpfs
>> ${BUILDCHROOT_DIR}/dev
>> +    sudo mount --bind -o ro /dev ${BUILDCHROOT_DIR}/dev
>>       sudo mount -t proc none ${BUILDCHROOT_DIR}/proc
>>         # Create root filesystem
>>
> 


-- 
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux