Re: [PATCH] rootfs: do not expose /sys/firmware while building root file-systems

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 17.06.25 14:58, 'MOESSBAUER, Felix' via isar-users wrote:
> On Tue, 2025-06-17 at 14:35 +0200, 'Cedric Hombourger' via isar-users
> wrote:
>> We need /sys while assembling the target root file-system but it
>> exposes
>> more than the build really needs. Some maintainer scripts (e.g.
>> mdmadm)
>> check /sys/firmware/efi/efivars while configuring themselves. This
>> would
>> normally be fine but for Isar builds, any information extracted from
>> there
>> is for the host doing the build and not for the target we are
>> building for.
>> In addition, packages seeing /sys/firmware/efi will mount efivars
>> there
>> and will cause do_rootfs_umount to fail unmounting /sys (because of
>> that
>> extra mount). By mounting a (small) tmpfs as /sys/firmware in the
>> root
>> file-system, we hide host details from the build; that extra mount
>> needs
>> to be removed before we attempt to unmount /sys (but we are in
>> control).
> 
> Good catch! Eventually all these mountpoints should be documented as
> well.
> 
>>
>> Signed-off-by: Cedric Hombourger <cedric.hombourger@siemens.com>
>> ---
>>  meta/classes/rootfs.bbclass | 9 +++++++++
>>  1 file changed, 9 insertions(+)
>>
>> diff --git a/meta/classes/rootfs.bbclass
>> b/meta/classes/rootfs.bbclass
>> index 5f877962..7b7859b9 100644
>> --- a/meta/classes/rootfs.bbclass
>> +++ b/meta/classes/rootfs.bbclass
>> @@ -48,6 +48,12 @@ rootfs_do_mounts() {
>>              mount -o bind,private /sys '${ROOTFSDIR}/sys'
>>          mount --make-rslave '${ROOTFSDIR}/sys'
>>  
>> +        # Mount a tmpfs on /sys/firmware to avoid host contamination
>> problems
>> +        # (maintainer scripts shouldn't pull host data from there)
>> +        if [ -d '${ROOTFSDIR}/sys/firmware' ]; then
>> +            mount -t tmpfs -o size=1m,nosuid,nodev none
>> '${ROOTFSDIR}/sys/firmware'
>> +        fi
>> +
> 
> Would bubblewrap help in this case? I'm also wondering if we really
> should bind-mount the devices from the host or better mknod them in the
> chroot.
> 
> Anyways, this discussion should not stop the patch from being merged.

...but what should be considered first if such an opt-out list only
needs to contain firmware or rather even more folders? Or sub-mounts on
sysfs in general?

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/92946c61-7192-44db-a3c6-489e7e1cf911%40siemens.com.