[PATCH] Avoid sharing of /dev/shm from the build context

[Jan Kiszka <jan.kiszka@siemens.com>]

From: Jan Kiszka <jan.kiszka@siemens.com>

By bind-mounting complete /dev into the various chroots, we also share
the host instance of /dev/shm between them. If some package installation
should actually make use of that tmpfs instance, it may find content of
others there. That is at least not desirable, in few cases even
problematic (sysrepo package uses it during postinst, and this causes
troubles when multiple images are built in parallel).

This decouples all instances by mounting new instances over the
bind-mounted ones.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 meta/classes/buildchroot.bbclass                    | 3 ++-
 meta/classes/rootfs.bbclass                         | 3 ++-
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 2 ++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/meta/classes/buildchroot.bbclass b/meta/classes/buildchroot.bbclass
index dd8f4206..3b214c6c 100644
--- a/meta/classes/buildchroot.bbclass
+++ b/meta/classes/buildchroot.bbclass
@@ -42,7 +42,8 @@ buildchroot_do_mounts() {
                 mount --bind '${CCACHE_DIR}' '${BUILDCHROOT_DIR}/ccache'
         fi
         mountpoint -q '${BUILDCHROOT_DIR}/dev' ||
-            mount --rbind /dev '${BUILDCHROOT_DIR}/dev'
+            ( mount --rbind /dev '${BUILDCHROOT_DIR}/dev';
+              mount -t tmpfs none '${BUILDCHROOT_DIR}/dev/shm' )
         mount --make-rslave '${BUILDCHROOT_DIR}/dev'
         mountpoint -q '${BUILDCHROOT_DIR}/proc' ||
             mount -t proc none '${BUILDCHROOT_DIR}/proc'
diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
index 927af13f..5dd40d93 100644
--- a/meta/classes/rootfs.bbclass
+++ b/meta/classes/rootfs.bbclass
@@ -34,7 +34,8 @@ rootfs_do_mounts() {
     sudo -s <<'EOSUDO'
         set -e
         mountpoint -q '${ROOTFSDIR}/dev' || \
-            mount --rbind /dev '${ROOTFSDIR}/dev'
+            ( mount --rbind /dev '${ROOTFSDIR}/dev';
+              mount -t tmpfs none '${ROOTFSDIR}/dev/shm' )
         mount --make-rslave '${ROOTFSDIR}/dev'
         mountpoint -q '${ROOTFSDIR}/proc' || \
             mount -t proc none '${ROOTFSDIR}/proc'
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index 1b16f874..7d94ede1 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -361,6 +361,7 @@ do_bootstrap() {
 
         # update APT
         mount --rbind /dev ${ROOTFSDIR}/dev
+        mount -t tmpfs none "${ROOTFSDIR}/dev/shm"
         mount --make-rslave ${ROOTFSDIR}/dev
         mount -t proc none ${ROOTFSDIR}/proc
         mount --rbind /sys ${ROOTFSDIR}/sys
@@ -381,6 +382,7 @@ do_bootstrap() {
         chroot "${ROOTFSDIR}" /usr/bin/apt-get dist-upgrade -y \
                                 -o Debug::pkgProblemResolver=yes
 
+        umount -l "${ROOTFSDIR}/dev/shm"
         umount -l "${ROOTFSDIR}/dev"
         umount -l "${ROOTFSDIR}/proc"
         umount -l "${ROOTFSDIR}/sys"
-- 
2.34.1