[PATCH 2/2] image: clear /run to not leak build system data

["'Felix Moessbauer' via isar-users" <isar-users@googlegroups.com>]

According to Filesystem Hierarchy Standard (FHS), /run is always a
tmpfs. On Debian buster this is already the case. We however need to
keep /run/lock due to debian policy 9.1.4. Clear the rest, to not
leak build system data into the image.

We have to do this in the finalize step, as nothing must be mounted.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/image.bbclass | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index 6b02ff8e..a44c6de4 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -470,8 +470,10 @@ do_rootfs_finalize() {
         # Clear /dev on schroot as mmdebstrap --skip=output/dev (unshare) does not deploy it
         find ${ROOTFSDIR}/dev -mindepth 1 -maxdepth 1 -exec rm -rf {} \;
 
-        rm -f "${ROOTFSDIR}/run/blkid/blkid.tab"
-        rm -f "${ROOTFSDIR}/run/blkid/blkid.tab.old"
+        # according to FHS, /run is a tmpfs. Clear it to not leak build system data
+        # skip deleting /run/lock as /var/lock is a symlink to it according to Debian policy 9.1.4
+        find ${ROOTFSDIR}/run/lock -mindepth 1 -maxdepth 1 -exec rm -rf {} \;
+        find ${ROOTFSDIR}/run -mindepth 1 -maxdepth 1 ! -name lock -exec rm -rf {} \;
 EOSUDO
 
     # Sometimes qemu-user-static generates coredumps in chroot, move them
-- 
2.53.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260706101217.1385245-2-felix.moessbauer%40siemens.com.