Re: [PATCH 1/1] isar-mounts: mount /run as tmpfs for systemd execution in chroot

[Zhihang Wei <wzh@ilbers.de>]

Applied to next, thanks.

Zhihang

On 9/23/26 16:33, 'Felix Moessbauer' via isar-users wrote:
> When running systemd inside the chroot, it might access /run and place
> files there. These can have ownerships (like 0000) which require DAC
> capabilities for traversing and removing. As this is tricky to achieve
> across all cleanup code, we stick to the systemd file system hierarchy
> and mount /run as a tmpfs. By that, all files below it will
> automatically be dropped when leaving the namespace.
>
> This solves cleanup issues on rootless like:
>    find: '<...>/rootfs/run/systemd/dissect-root': Permission denied
>
> As we anyways cleanup the /run in do_rootfs_finalize (image only), this
> does not change the content of the image. However, it improves the
> reproduciblity of our internal rootfs' which can improve caching.
>
> Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>   meta/classes-global/base.bbclass | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass
> index 8f81ab70..3d5d1c12 100644
> --- a/meta/classes-global/base.bbclass
> +++ b/meta/classes-global/base.bbclass
> @@ -399,6 +399,10 @@ def insert_isar_mounts(d, rootfs, mounts):
>           lines.append('mount -t devpts -o noexec,nosuid,uid=5,mode=620,ptmxmode=666 none {}/dev/pts'.format(rootfs))
>           lines.append('( cd {}/dev; ln -sf pts/ptmx . )'.format(rootfs))
>           lines.append('mount -t tmpfs none {}/dev/shm'.format(rootfs))
> +        # required by systemd file-system hierarchy
> +        lines.append('mount -t tmpfs -o mode=0755 tmpfs {}/run'.format(rootfs))
> +        # required by Debian policy 9.1.4
> +        lines.append('mkdir {}/run/lock'.format(rootfs))
>           lines.append('mount -o bind /dev/random {}/dev/random'.format(rootfs))
>           lines.append('mount -o bind /dev/urandom {}/dev/urandom'.format(rootfs))
>           lines.append('mount -t proc none {}/proc'.format(rootfs))

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/64f00659-3c6a-4b57-96c7-3499e6ce65a8%40ilbers.de.