[PATCH 1/2] image: delete entries below /dev

[PATCH 1/2] image: delete entries below /dev

['Felix Moessbauer' via isar-users]

These are generally not needed, as /dev is over-mounted by systemd on
boot. When bootstrapping via unshare, these entries are not present,
as the /dev is mounted when entering the namespace. As a preparation
to make the images built with unshare and schroot bit identical, we
have to delete these entries under schroot.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/image.bbclass | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index 26a4ec06..6b02ff8e 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -467,6 +467,9 @@ do_rootfs_finalize() {
             done
         fi
 
+        # Clear /dev on schroot as mmdebstrap --skip=output/dev (unshare) does not deploy it
+        find ${ROOTFSDIR}/dev -mindepth 1 -maxdepth 1 -exec rm -rf {} \;
+
         rm -f "${ROOTFSDIR}/run/blkid/blkid.tab"
         rm -f "${ROOTFSDIR}/run/blkid/blkid.tab.old"
 EOSUDO
-- 
2.53.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260706101217.1385245-1-felix.moessbauer%40siemens.com.

[PATCH 2/2] image: clear /run to not leak build system data

['Felix Moessbauer' via isar-users]

According to Filesystem Hierarchy Standard (FHS), /run is always a
tmpfs. On Debian buster this is already the case. We however need to
keep /run/lock due to debian policy 9.1.4. Clear the rest, to not
leak build system data into the image.

We have to do this in the finalize step, as nothing must be mounted.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/image.bbclass | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index 6b02ff8e..a44c6de4 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -470,8 +470,10 @@ do_rootfs_finalize() {
         # Clear /dev on schroot as mmdebstrap --skip=output/dev (unshare) does not deploy it
         find ${ROOTFSDIR}/dev -mindepth 1 -maxdepth 1 -exec rm -rf {} \;
 
-        rm -f "${ROOTFSDIR}/run/blkid/blkid.tab"
-        rm -f "${ROOTFSDIR}/run/blkid/blkid.tab.old"
+        # according to FHS, /run is a tmpfs. Clear it to not leak build system data
+        # skip deleting /run/lock as /var/lock is a symlink to it according to Debian policy 9.1.4
+        find ${ROOTFSDIR}/run/lock -mindepth 1 -maxdepth 1 -exec rm -rf {} \;
+        find ${ROOTFSDIR}/run -mindepth 1 -maxdepth 1 ! -name lock -exec rm -rf {} \;
 EOSUDO
 
     # Sometimes qemu-user-static generates coredumps in chroot, move them
-- 
2.53.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260706101217.1385245-2-felix.moessbauer%40siemens.com.