[PATCH v3] Avoid sharing of /dev/shm from the build context

[Jan Kiszka <jan.kiszka@siemens.com>]

From: Jan Kiszka <jan.kiszka@siemens.com>

By bind-mounting complete /dev into the various chroots, we also share
the host instance of /dev/shm between them. If some package installation
should actually make use of that tmpfs instance, it may find content of
others there. That is at least not desirable, in few cases even
problematic (sysrepo package uses it during postinst, and this causes
troubles when multiple images are built in parallel).

This decouples all instances by mounting new instances over the
bind-mounted ones.

While at it, it switches the recursive bind-mounting of /dev to
explicit one. /dev/shm then becomes the only sub-mount. This is assumed
to be sufficient for the given use cases.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---

Changes in v3:
 - drop rslave for /dev

 meta/classes/buildchroot.bbclass                    | 4 ++--
 meta/classes/rootfs.bbclass                         | 4 ++--
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 5 +++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/meta/classes/buildchroot.bbclass b/meta/classes/buildchroot.bbclass
index dd8f4206..3d2211b9 100644
--- a/meta/classes/buildchroot.bbclass
+++ b/meta/classes/buildchroot.bbclass
@@ -42,8 +42,8 @@ buildchroot_do_mounts() {
                 mount --bind '${CCACHE_DIR}' '${BUILDCHROOT_DIR}/ccache'
         fi
         mountpoint -q '${BUILDCHROOT_DIR}/dev' ||
-            mount --rbind /dev '${BUILDCHROOT_DIR}/dev'
-        mount --make-rslave '${BUILDCHROOT_DIR}/dev'
+            ( mount --bind /dev '${BUILDCHROOT_DIR}/dev' &&
+              mount -t tmpfs none '${BUILDCHROOT_DIR}/dev/shm' )
         mountpoint -q '${BUILDCHROOT_DIR}/proc' ||
             mount -t proc none '${BUILDCHROOT_DIR}/proc'
         mountpoint -q '${BUILDCHROOT_DIR}/sys' ||
diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
index 927af13f..d760ba5c 100644
--- a/meta/classes/rootfs.bbclass
+++ b/meta/classes/rootfs.bbclass
@@ -34,8 +34,8 @@ rootfs_do_mounts() {
     sudo -s <<'EOSUDO'
         set -e
         mountpoint -q '${ROOTFSDIR}/dev' || \
-            mount --rbind /dev '${ROOTFSDIR}/dev'
-        mount --make-rslave '${ROOTFSDIR}/dev'
+            ( mount --bind /dev '${ROOTFSDIR}/dev' &&
+              mount -t tmpfs none '${ROOTFSDIR}/dev/shm' )
         mountpoint -q '${ROOTFSDIR}/proc' || \
             mount -t proc none '${ROOTFSDIR}/proc'
         mountpoint -q '${ROOTFSDIR}/sys' || \
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index 1b16f874..c7fc2b4f 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -360,8 +360,8 @@ do_bootstrap() {
         "${ROOTFSDIR}/chroot-setup.sh" "setup" "${ROOTFSDIR}"
 
         # update APT
-        mount --rbind /dev ${ROOTFSDIR}/dev
-        mount --make-rslave ${ROOTFSDIR}/dev
+        mount --bind /dev ${ROOTFSDIR}/dev
+        mount -t tmpfs none "${ROOTFSDIR}/dev/shm"
         mount -t proc none ${ROOTFSDIR}/proc
         mount --rbind /sys ${ROOTFSDIR}/sys
         mount --make-rslave ${ROOTFSDIR}/sys
@@ -381,6 +381,7 @@ do_bootstrap() {
         chroot "${ROOTFSDIR}" /usr/bin/apt-get dist-upgrade -y \
                                 -o Debug::pkgProblemResolver=yes
 
+        umount -l "${ROOTFSDIR}/dev/shm"
         umount -l "${ROOTFSDIR}/dev"
         umount -l "${ROOTFSDIR}/proc"
         umount -l "${ROOTFSDIR}/sys"
-- 
2.34.1