public inbox for isar-users@googlegroups.com
 help / color / mirror / Atom feed
* [PATCH v3] Avoid sharing of /dev/shm from the build context
@ 2022-03-21 11:50 Jan Kiszka
  2022-03-21 12:01 ` Baurzhan Ismagulov
  2022-03-28 17:49 ` Anton Mikanovich
  0 siblings, 2 replies; 3+ messages in thread
From: Jan Kiszka @ 2022-03-21 11:50 UTC (permalink / raw)
  To: isar-users

From: Jan Kiszka <jan.kiszka@siemens.com>

By bind-mounting complete /dev into the various chroots, we also share
the host instance of /dev/shm between them. If some package installation
should actually make use of that tmpfs instance, it may find content of
others there. That is at least not desirable, in few cases even
problematic (sysrepo package uses it during postinst, and this causes
troubles when multiple images are built in parallel).

This decouples all instances by mounting new instances over the
bind-mounted ones.

While at it, it switches the recursive bind-mounting of /dev to
explicit one. /dev/shm then becomes the only sub-mount. This is assumed
to be sufficient for the given use cases.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---

Changes in v3:
 - drop rslave for /dev

 meta/classes/buildchroot.bbclass                    | 4 ++--
 meta/classes/rootfs.bbclass                         | 4 ++--
 meta/recipes-core/isar-bootstrap/isar-bootstrap.inc | 5 +++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/meta/classes/buildchroot.bbclass b/meta/classes/buildchroot.bbclass
index dd8f4206..3d2211b9 100644
--- a/meta/classes/buildchroot.bbclass
+++ b/meta/classes/buildchroot.bbclass
@@ -42,8 +42,8 @@ buildchroot_do_mounts() {
                 mount --bind '${CCACHE_DIR}' '${BUILDCHROOT_DIR}/ccache'
         fi
         mountpoint -q '${BUILDCHROOT_DIR}/dev' ||
-            mount --rbind /dev '${BUILDCHROOT_DIR}/dev'
-        mount --make-rslave '${BUILDCHROOT_DIR}/dev'
+            ( mount --bind /dev '${BUILDCHROOT_DIR}/dev' &&
+              mount -t tmpfs none '${BUILDCHROOT_DIR}/dev/shm' )
         mountpoint -q '${BUILDCHROOT_DIR}/proc' ||
             mount -t proc none '${BUILDCHROOT_DIR}/proc'
         mountpoint -q '${BUILDCHROOT_DIR}/sys' ||
diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
index 927af13f..d760ba5c 100644
--- a/meta/classes/rootfs.bbclass
+++ b/meta/classes/rootfs.bbclass
@@ -34,8 +34,8 @@ rootfs_do_mounts() {
     sudo -s <<'EOSUDO'
         set -e
         mountpoint -q '${ROOTFSDIR}/dev' || \
-            mount --rbind /dev '${ROOTFSDIR}/dev'
-        mount --make-rslave '${ROOTFSDIR}/dev'
+            ( mount --bind /dev '${ROOTFSDIR}/dev' &&
+              mount -t tmpfs none '${ROOTFSDIR}/dev/shm' )
         mountpoint -q '${ROOTFSDIR}/proc' || \
             mount -t proc none '${ROOTFSDIR}/proc'
         mountpoint -q '${ROOTFSDIR}/sys' || \
diff --git a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
index 1b16f874..c7fc2b4f 100644
--- a/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
+++ b/meta/recipes-core/isar-bootstrap/isar-bootstrap.inc
@@ -360,8 +360,8 @@ do_bootstrap() {
         "${ROOTFSDIR}/chroot-setup.sh" "setup" "${ROOTFSDIR}"
 
         # update APT
-        mount --rbind /dev ${ROOTFSDIR}/dev
-        mount --make-rslave ${ROOTFSDIR}/dev
+        mount --bind /dev ${ROOTFSDIR}/dev
+        mount -t tmpfs none "${ROOTFSDIR}/dev/shm"
         mount -t proc none ${ROOTFSDIR}/proc
         mount --rbind /sys ${ROOTFSDIR}/sys
         mount --make-rslave ${ROOTFSDIR}/sys
@@ -381,6 +381,7 @@ do_bootstrap() {
         chroot "${ROOTFSDIR}" /usr/bin/apt-get dist-upgrade -y \
                                 -o Debug::pkgProblemResolver=yes
 
+        umount -l "${ROOTFSDIR}/dev/shm"
         umount -l "${ROOTFSDIR}/dev"
         umount -l "${ROOTFSDIR}/proc"
         umount -l "${ROOTFSDIR}/sys"
-- 
2.34.1

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-03-28 17:49 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-21 11:50 [PATCH v3] Avoid sharing of /dev/shm from the build context Jan Kiszka
2022-03-21 12:01 ` Baurzhan Ismagulov
2022-03-28 17:49 ` Anton Mikanovich

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox