[PATCH v3] Avoid sharing of /dev/shm from the build context

[PATCH v3] Avoid sharing of /dev/shm from the build context

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

By bind-mounting complete /dev into the various chroots, we also share
the host instance of /dev/shm between them. If some package installation
should actually make use of that tmpfs instance, it may find content of
others there. That is at least not desirable, in few cases even
problematic (sysrepo package uses it during postinst, and this causes
troubles when multiple images are built in parallel).

This decouples all instances by mounting new instances over the
bind-mounted ones.

While at it, it switches the recursive bind-mounting of /dev to
explicit one. /dev/shm then becomes the only sub-mount. This is assumed
to be sufficient for the given use cases.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---

Changes in v3:
 - drop rslave for /dev

 meta/classes/buildchroot.bbclass                    | 4 ++--
 meta/classes/rootfs.bbclass                         | 4 ++--
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 5 +++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/meta/classes/buildchroot.bbclass b/meta/classes/buildchroot.bbclass
index dd8f4206..3d2211b9 100644
--- a/meta/classes/buildchroot.bbclass
+++ b/meta/classes/buildchroot.bbclass
@@ -42,8 +42,8 @@ buildchroot_do_mounts() {
                 mount --bind '${CCACHE_DIR}' '${BUILDCHROOT_DIR}/ccache'
         fi
         mountpoint -q '${BUILDCHROOT_DIR}/dev' ||
-            mount --rbind /dev '${BUILDCHROOT_DIR}/dev'
-        mount --make-rslave '${BUILDCHROOT_DIR}/dev'
+            ( mount --bind /dev '${BUILDCHROOT_DIR}/dev' &&
+              mount -t tmpfs none '${BUILDCHROOT_DIR}/dev/shm' )
         mountpoint -q '${BUILDCHROOT_DIR}/proc' ||
             mount -t proc none '${BUILDCHROOT_DIR}/proc'
         mountpoint -q '${BUILDCHROOT_DIR}/sys' ||
diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
index 927af13f..d760ba5c 100644
--- a/meta/classes/rootfs.bbclass
+++ b/meta/classes/rootfs.bbclass
@@ -34,8 +34,8 @@ rootfs_do_mounts() {
     sudo -s <<'EOSUDO'
         set -e
         mountpoint -q '${ROOTFSDIR}/dev' || \
-            mount --rbind /dev '${ROOTFSDIR}/dev'
-        mount --make-rslave '${ROOTFSDIR}/dev'
+            ( mount --bind /dev '${ROOTFSDIR}/dev' &&
+              mount -t tmpfs none '${ROOTFSDIR}/dev/shm' )
         mountpoint -q '${ROOTFSDIR}/proc' || \
             mount -t proc none '${ROOTFSDIR}/proc'
         mountpoint -q '${ROOTFSDIR}/sys' || \
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index 1b16f874..c7fc2b4f 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -360,8 +360,8 @@ do_bootstrap() {
         "${ROOTFSDIR}/chroot-setup.sh" "setup" "${ROOTFSDIR}"
 
         # update APT
-        mount --rbind /dev ${ROOTFSDIR}/dev
-        mount --make-rslave ${ROOTFSDIR}/dev
+        mount --bind /dev ${ROOTFSDIR}/dev
+        mount -t tmpfs none "${ROOTFSDIR}/dev/shm"
         mount -t proc none ${ROOTFSDIR}/proc
         mount --rbind /sys ${ROOTFSDIR}/sys
         mount --make-rslave ${ROOTFSDIR}/sys
@@ -381,6 +381,7 @@ do_bootstrap() {
         chroot "${ROOTFSDIR}" /usr/bin/apt-get dist-upgrade -y \
                                 -o Debug::pkgProblemResolver=yes
 
+        umount -l "${ROOTFSDIR}/dev/shm"
         umount -l "${ROOTFSDIR}/dev"
         umount -l "${ROOTFSDIR}/proc"
         umount -l "${ROOTFSDIR}/sys"
-- 
2.34.1

Re: [PATCH v3] Avoid sharing of /dev/shm from the build context

[Baurzhan Ismagulov]

On Mon, Mar 21, 2022 at 12:50:53PM +0100, Jan Kiszka wrote:
> diff --git a/meta/classes/buildchroot.bbclass b/meta/classes/buildchroot.bbclass
> index dd8f4206..3d2211b9 100644
> --- a/meta/classes/buildchroot.bbclass
> +++ b/meta/classes/buildchroot.bbclass
> @@ -42,8 +42,8 @@ buildchroot_do_mounts() {
>                  mount --bind '${CCACHE_DIR}' '${BUILDCHROOT_DIR}/ccache'
>          fi
>          mountpoint -q '${BUILDCHROOT_DIR}/dev' ||
> -            mount --rbind /dev '${BUILDCHROOT_DIR}/dev'
> -        mount --make-rslave '${BUILDCHROOT_DIR}/dev'
> +            ( mount --bind /dev '${BUILDCHROOT_DIR}/dev' &&
> +              mount -t tmpfs none '${BUILDCHROOT_DIR}/dev/shm' )
>          mountpoint -q '${BUILDCHROOT_DIR}/proc' ||
>              mount -t proc none '${BUILDCHROOT_DIR}/proc'
>          mountpoint -q '${BUILDCHROOT_DIR}/sys' ||
> diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
> index 927af13f..d760ba5c 100644
> --- a/meta/classes/rootfs.bbclass
> +++ b/meta/classes/rootfs.bbclass
> @@ -34,8 +34,8 @@ rootfs_do_mounts() {
>      sudo -s <<'EOSUDO'
>          set -e
>          mountpoint -q '${ROOTFSDIR}/dev' || \
> -            mount --rbind /dev '${ROOTFSDIR}/dev'
> -        mount --make-rslave '${ROOTFSDIR}/dev'
> +            ( mount --bind /dev '${ROOTFSDIR}/dev' &&
> +              mount -t tmpfs none '${ROOTFSDIR}/dev/shm' )
>          mountpoint -q '${ROOTFSDIR}/proc' || \
>              mount -t proc none '${ROOTFSDIR}/proc'
>          mountpoint -q '${ROOTFSDIR}/sys' || \
> diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> index 1b16f874..c7fc2b4f 100644
> --- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> +++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> @@ -360,8 +360,8 @@ do_bootstrap() {
>          "${ROOTFSDIR}/chroot-setup.sh" "setup" "${ROOTFSDIR}"
>  
>          # update APT
> -        mount --rbind /dev ${ROOTFSDIR}/dev
> -        mount --make-rslave ${ROOTFSDIR}/dev
> +        mount --bind /dev ${ROOTFSDIR}/dev
> +        mount -t tmpfs none "${ROOTFSDIR}/dev/shm"
>          mount -t proc none ${ROOTFSDIR}/proc
>          mount --rbind /sys ${ROOTFSDIR}/sys
>          mount --make-rslave ${ROOTFSDIR}/sys
> @@ -381,6 +381,7 @@ do_bootstrap() {
>          chroot "${ROOTFSDIR}" /usr/bin/apt-get dist-upgrade -y \
>                                  -o Debug::pkgProblemResolver=yes
>  
> +        umount -l "${ROOTFSDIR}/dev/shm"
>          umount -l "${ROOTFSDIR}/dev"
>          umount -l "${ROOTFSDIR}/proc"
>          umount -l "${ROOTFSDIR}/sys"

Thanks, LGTM.

I hope we can address lazy umounts in the next mount rework version.

With kind regards,
Baurzhan.

Re: [PATCH v3] Avoid sharing of /dev/shm from the build context

[Anton Mikanovich]

21.03.2022 14:50, Jan Kiszka wrote:
> From: Jan Kiszka <jan.kiszka@siemens.com>
>
> By bind-mounting complete /dev into the various chroots, we also share
> the host instance of /dev/shm between them. If some package installation
> should actually make use of that tmpfs instance, it may find content of
> others there. That is at least not desirable, in few cases even
> problematic (sysrepo package uses it during postinst, and this causes
> troubles when multiple images are built in parallel).
>
> This decouples all instances by mounting new instances over the
> bind-mounted ones.
>
> While at it, it switches the recursive bind-mounting of /dev to
> explicit one. /dev/shm then becomes the only sub-mount. This is assumed
> to be sufficient for the given use cases.
>
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

Applied to next, thanks.