Re: [PATCH] Avoid sharing of /dev/shm from the build context

[Jan Kiszka <jan.kiszka@siemens.com>]

On 17.03.22 18:37, Jan Kiszka wrote:
> From: Jan Kiszka <jan.kiszka@siemens.com>
> 
> By bind-mounting complete /dev into the various chroots, we also share
> the host instance of /dev/shm between them. If some package installation
> should actually make use of that tmpfs instance, it may find content of
> others there. That is at least not desirable, in few cases even
> problematic (sysrepo package uses it during postinst, and this causes
> troubles when multiple images are built in parallel).
> 
> This decouples all instances by mounting new instances over the
> bind-mounted ones.
> 
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>  meta/classes/buildchroot.bbclass                    | 3 ++-
>  meta/classes/rootfs.bbclass                         | 3 ++-
>  meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 2 ++
>  3 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/meta/classes/buildchroot.bbclass b/meta/classes/buildchroot.bbclass
> index dd8f4206..3b214c6c 100644
> --- a/meta/classes/buildchroot.bbclass
> +++ b/meta/classes/buildchroot.bbclass
> @@ -42,7 +42,8 @@ buildchroot_do_mounts() {
>                  mount --bind '${CCACHE_DIR}' '${BUILDCHROOT_DIR}/ccache'
>          fi
>          mountpoint -q '${BUILDCHROOT_DIR}/dev' ||
> -            mount --rbind /dev '${BUILDCHROOT_DIR}/dev'
> +            ( mount --rbind /dev '${BUILDCHROOT_DIR}/dev';
> +              mount -t tmpfs none '${BUILDCHROOT_DIR}/dev/shm' )
>          mount --make-rslave '${BUILDCHROOT_DIR}/dev'
>          mountpoint -q '${BUILDCHROOT_DIR}/proc' ||
>              mount -t proc none '${BUILDCHROOT_DIR}/proc'
> diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
> index 927af13f..5dd40d93 100644
> --- a/meta/classes/rootfs.bbclass
> +++ b/meta/classes/rootfs.bbclass
> @@ -34,7 +34,8 @@ rootfs_do_mounts() {
>      sudo -s <<'EOSUDO'
>          set -e
>          mountpoint -q '${ROOTFSDIR}/dev' || \
> -            mount --rbind /dev '${ROOTFSDIR}/dev'
> +            ( mount --rbind /dev '${ROOTFSDIR}/dev';
> +              mount -t tmpfs none '${ROOTFSDIR}/dev/shm' )
>          mount --make-rslave '${ROOTFSDIR}/dev'
>          mountpoint -q '${ROOTFSDIR}/proc' || \
>              mount -t proc none '${ROOTFSDIR}/proc'
> diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> index 1b16f874..7d94ede1 100644
> --- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> +++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
> @@ -361,6 +361,7 @@ do_bootstrap() {
>  
>          # update APT
>          mount --rbind /dev ${ROOTFSDIR}/dev
> +        mount -t tmpfs none "${ROOTFSDIR}/dev/shm"
>          mount --make-rslave ${ROOTFSDIR}/dev
>          mount -t proc none ${ROOTFSDIR}/proc
>          mount --rbind /sys ${ROOTFSDIR}/sys
> @@ -381,6 +382,7 @@ do_bootstrap() {
>          chroot "${ROOTFSDIR}" /usr/bin/apt-get dist-upgrade -y \
>                                  -o Debug::pkgProblemResolver=yes
>  
> +        umount -l "${ROOTFSDIR}/dev/shm"
>          umount -l "${ROOTFSDIR}/dev"
>          umount -l "${ROOTFSDIR}/proc"
>          umount -l "${ROOTFSDIR}/sys"

Uladzimir, didn't check if this is going to be completely obsoleted by
sbuild. If so, this can be ignored, and we will carry it locally until
sbuild is merged.

Jan

-- 
Siemens AG, Technology
Competence Center Embedded Linux