From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6523072403514327040 X-Received: by 10.223.142.69 with SMTP id n63mr985574wrb.28.1519114696543; Tue, 20 Feb 2018 00:18:16 -0800 (PST) X-BeenThere: isar-users@googlegroups.com Received: by 10.28.9.70 with SMTP id 67ls1835147wmj.7.canary-gmail; Tue, 20 Feb 2018 00:18:16 -0800 (PST) X-Google-Smtp-Source: AH8x224VIpCQS5nNNHtjkO3erelfrxAdCdDePCaB7X+WCbadMO+G0RFjxoALajVqtjsoyJKtnxU/ X-Received: by 10.28.69.76 with SMTP id s73mr2460628wma.15.1519114696067; Tue, 20 Feb 2018 00:18:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519114696; cv=none; d=google.com; s=arc-20160816; b=G6x8eE7/WPWrWcP1zXWSG+9AFZqHsAFb4uslAh//vW0aBC1shHp3gFj2a/ihJtvJ9Z 0fyTF49O8826V61z70hHviWB56YtxXjwsFeY+t3c6Ywte0jyEnylKN2B2BklVcBYQeTf 8u/IZ7ZLg5gx0VyEqZnaHbrhu7CAzno8TViRXqzT2On10KME/npmhmPEuvibHXdMY1nb gOCxsoHzLH6wxCrvCI8OpBQF3bzkIP2FMXe48ZFvI6qYz41VO0EgcmpcOq5CB5fpttQj lrdi7uldqVT/kYDxQ3goRN1Nx92xFiFxCk1rsAISJAe3Ej+pUQu9YrCvYw3C8tS5tngA w2kw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:to:subject :arc-authentication-results; bh=IBYbzRINVky4tt5tHG1QRNK0WHbuSzH5wecKvYWvBg0=; b=a5MMRHx9JLquknr3YbErvLDtZHEDb6P8X88b2Bf3o4D3Q9QuEjiocC3SDT3AszRuO0 WDkWf0+vLy9a0mvRaCxZQ1ooO7DiDMR8WB3T+hU87iqIrXVj18zFP/PbRjuXizs+IR7h vsPQTk9BrVujM7I0Vr0M12/P75YjlLjRIN+Ob6Fn7Qr9EliZDHZIPAmjFflG8RreWulb bTOX5De2mHdOsLmnQRI8EgwtiAPJIRD8P/NAGKaXkjfRgWgHmWx2k0FvQN7PsIFat+QY z8V9M7zcikdX+OWmw8/nHWrhYeqgkVTAz8PPeau/BgDixFEwdHfANVLu7pMIO1t/6v+Z 4szQ== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of claudius.heine.ext@siemens.com designates 192.35.17.14 as permitted sender) smtp.mailfrom=claudius.heine.ext@siemens.com Return-Path: Received: from david.siemens.de (david.siemens.de. [192.35.17.14]) by gmr-mx.google.com with ESMTPS id i44si233144wri.1.2018.02.20.00.18.15 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 20 Feb 2018 00:18:16 -0800 (PST) Received-SPF: pass (google.com: domain of claudius.heine.ext@siemens.com designates 192.35.17.14 as permitted sender) client-ip=192.35.17.14; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of claudius.heine.ext@siemens.com designates 192.35.17.14 as permitted sender) smtp.mailfrom=claudius.heine.ext@siemens.com Received: from mail2.sbs.de (mail2.sbs.de [192.129.41.66]) by david.siemens.de (8.15.2/8.15.2) with ESMTPS id w1K8IFgL030080 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 20 Feb 2018 09:18:15 +0100 Received: from [139.25.68.223] (linux-ses-ext02.ppmd.siemens.net [139.25.68.223]) by mail2.sbs.de (8.15.2/8.15.2) with ESMTP id w1K8IEv3008361; Tue, 20 Feb 2018 09:18:14 +0100 Subject: Re: [PATCH 1/8] Mount devtmpfs read-only into chroot To: "[ext] Jan Kiszka" , Alexander Smirnov , isar-users References: <02a592150c34714e0729d4fc73f86ff031fee514.1518771143.git.jan.kiszka@siemens.com> <7e4d36c6-9556-6a69-9ffa-dfbc2e1744ba@ilbers.de> <04a11ae7-172c-474d-8e59-a0f5e5465884@siemens.com> From: Claudius Heine Message-ID: Date: Tue, 20 Feb 2018 09:18:14 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <04a11ae7-172c-474d-8e59-a0f5e5465884@siemens.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-TUID: wCYkLJeu1SG4 Hi, On 02/20/2018 08:03 AM, [ext] Jan Kiszka wrote: > On 2018-02-20 07:38, Alexander Smirnov wrote: >> On 02/16/2018 11:52 AM, Jan Kiszka wrote: >>> From: Jan Kiszka >>> >>> It's too easy to destroy the content of devtmpfs, which is shared with >>> the host (including privileged container setups), by calling rm -rf on >>> an output dir that still has devtmpfs mounted. >>> >> >> Just tested this: >> >> builder@zbook:~/isar/build$ mkdir aaa >> builder@zbook:~/isar/build$ mount -t devtmpfs -o mode=0755,nosuid,ro >> devtmpfs aaa/ > > I've tried that path first, but it turns all mount points of devtmpfs > into read-only mode - not a good idea... > > I think we need to go back to mknod for the rootfs. If we do that, can we put that into a central function somewhere? Cheers, Claudius -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de