Re: [PATCH 1/8] Mount devtmpfs read-only into chroot

[Claudius Heine <claudius.heine.ext@siemens.com>]

Hi,

On 02/20/2018 08:03 AM, [ext] Jan Kiszka wrote:
> On 2018-02-20 07:38, Alexander Smirnov wrote:
>> On 02/16/2018 11:52 AM, Jan Kiszka wrote:
>>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>>
>>> It's too easy to destroy the content of devtmpfs, which is shared with
>>> the host (including privileged container setups), by calling rm -rf on
>>> an output dir that still has devtmpfs mounted.
>>>
>>
>> Just tested this:
>>
>> builder@zbook:~/isar/build$ mkdir aaa
>> builder@zbook:~/isar/build$ mount -t devtmpfs -o mode=0755,nosuid,ro
>> devtmpfs aaa/
> 
> I've tried that path first, but it turns all mount points of devtmpfs
> into read-only mode - not a good idea...
> 
> I think we need to go back to mknod for the rootfs.

If we do that, can we put that into a central function somewhere?

Cheers,
Claudius

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de