Re: [PATCH] rootfs: do not expose /sys/firmware while building root file-systems

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Tue, 2025-06-17 at 14:35 +0200, 'Cedric Hombourger' via isar-users
wrote:
> We need /sys while assembling the target root file-system but it
> exposes
> more than the build really needs. Some maintainer scripts (e.g.
> mdmadm)
> check /sys/firmware/efi/efivars while configuring themselves. This
> would
> normally be fine but for Isar builds, any information extracted from
> there
> is for the host doing the build and not for the target we are
> building for.
> In addition, packages seeing /sys/firmware/efi will mount efivars
> there
> and will cause do_rootfs_umount to fail unmounting /sys (because of
> that
> extra mount). By mounting a (small) tmpfs as /sys/firmware in the
> root
> file-system, we hide host details from the build; that extra mount
> needs
> to be removed before we attempt to unmount /sys (but we are in
> control).

Good catch! Eventually all these mountpoints should be documented as
well.

> 
> Signed-off-by: Cedric Hombourger <cedric.hombourger@siemens.com>
> ---
>  meta/classes/rootfs.bbclass | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/meta/classes/rootfs.bbclass
> b/meta/classes/rootfs.bbclass
> index 5f877962..7b7859b9 100644
> --- a/meta/classes/rootfs.bbclass
> +++ b/meta/classes/rootfs.bbclass
> @@ -48,6 +48,12 @@ rootfs_do_mounts() {
>              mount -o bind,private /sys '${ROOTFSDIR}/sys'
>          mount --make-rslave '${ROOTFSDIR}/sys'
>  
> +        # Mount a tmpfs on /sys/firmware to avoid host contamination
> problems
> +        # (maintainer scripts shouldn't pull host data from there)
> +        if [ -d '${ROOTFSDIR}/sys/firmware' ]; then
> +            mount -t tmpfs -o size=1m,nosuid,nodev none
> '${ROOTFSDIR}/sys/firmware'
> +        fi
> +

Would bubblewrap help in this case? I'm also wondering if we really
should bind-mount the devices from the host or better mknod them in the
chroot.

Anyways, this discussion should not stop the patch from being merged.

Felix

>          # Mount isar-apt if the directory does not exist or if it is
> empty
>          # This prevents overwriting something that was copied there
>          if [ ! -e '${ROOTFSDIR}/isar-apt' ] || \
> @@ -94,6 +100,9 @@ rootfs_do_umounts() {
>          if mountpoint -q '${ROOTFSDIR}/proc'; then
>              umount '${ROOTFSDIR}/proc'
>          fi
> +        if mountpoint -q '${ROOTFSDIR}/sys/firmware'; then
> +            umount '${ROOTFSDIR}/sys/firmware'
> +        fi
>          if mountpoint -q '${ROOTFSDIR}/sys'; then
>              umount '${ROOTFSDIR}/sys'
>          fi
> -- 
> 2.39.5

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/23351a3bdc42f238a0b8341afd2d3611d5cbca03.camel%40siemens.com.