Re: [PATCH 1/8] Mount devtmpfs read-only into chroot

[Alexander Smirnov <asmirnov@ilbers.de>]

On 02/16/2018 11:52 AM, Jan Kiszka wrote:
> From: Jan Kiszka <jan.kiszka@siemens.com>
> 
> It's too easy to destroy the content of devtmpfs, which is shared with
> the host (including privileged container setups), by calling rm -rf on
> an output dir that still has devtmpfs mounted.
> 

Just tested this:

builder@zbook:~/isar/build$ mkdir aaa
builder@zbook:~/isar/build$ mount -t devtmpfs -o mode=0755,nosuid,ro 
devtmpfs aaa/

# Existing host /dev
[asmirnov@zbook patches]$ sudo rm /dev/ram16
OK

# RO mount point
builder@zbook:~/isar/build$ sudo rm aaa/ram15
rm: cannot remove ‘aaa/ram15’: Read-only file system

What I'm doing wrong?

BTW: started test build on server to check if problem with wheezy will go.

Alex

> To achieve write protection for device nodes, we can't mount devtmpfs
> directly in read-only mode as that will change all mounts to that mode.
> Luckily, doing a read-only bind-mount does the trick.
> 
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>   meta/classes/dpkg-base.bbclass                   | 2 +-
>   meta/recipes-devtools/buildchroot/buildchroot.bb | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/meta/classes/dpkg-base.bbclass b/meta/classes/dpkg-base.bbclass
> index 5eef11b..78709f9 100644
> --- a/meta/classes/dpkg-base.bbclass
> +++ b/meta/classes/dpkg-base.bbclass
> @@ -41,7 +41,7 @@ do_build() {
>           if ! grep -q ${BUILDCHROOT_DIR}/isar-apt /proc/mounts; then \
>               mount --bind ${DEPLOY_DIR_APT}/${DISTRO} ${BUILDCHROOT_DIR}/isar-apt; \
>               mount --bind ${DL_DIR} ${BUILDCHROOT_DIR}/downloads; \
> -            mount -t devtmpfs -o mode=0755,nosuid devtmpfs ${BUILDCHROOT_DIR}/dev; \
> +            mount --bind -o ro /dev ${BUILDCHROOT_DIR}/dev; \
>               mount -t proc none ${BUILDCHROOT_DIR}/proc; \
>           fi'
>   
> diff --git a/meta/recipes-devtools/buildchroot/buildchroot.bb b/meta/recipes-devtools/buildchroot/buildchroot.bb
> index 520daf9..1eca035 100644
> --- a/meta/recipes-devtools/buildchroot/buildchroot.bb
> +++ b/meta/recipes-devtools/buildchroot/buildchroot.bb
> @@ -66,7 +66,7 @@ do_build() {
>              "${WORKDIR}/multistrap.conf.in" > "${WORKDIR}/multistrap.conf"
>   
>       sudo mount --bind ${DEPLOY_DIR_APT}/${DISTRO} ${BUILDCHROOT_DIR}/isar-apt
> -    sudo mount -t devtmpfs -o mode=0755,nosuid devtmpfs ${BUILDCHROOT_DIR}/dev
> +    sudo mount --bind -o ro /dev ${BUILDCHROOT_DIR}/dev
>       sudo mount -t proc none ${BUILDCHROOT_DIR}/proc
>   
>       # Create root filesystem
> 

-- 
With best regards,
Alexander Smirnov

ilbers GmbH
Baierbrunner Str. 28c
D-81379 Munich
+49 (89) 122 67 24-0
http://ilbers.de/
Commercial register Munich, HRB 214197
General manager: Baurzhan Ismagulov