On Wed, Jan 1, 2014 at 1:18 PM, Douglas Freed <[email protected]> wrote: > Bind mounting /dev/shm into the chroot isn't a good idea, as there may > be collisions and result in weird side effects. Instead, we can just > mount a new tmpfs there, with the right options to ensure security. > --- > modules/generic_stage_target.py | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/modules/generic_stage_target.py b/modules/generic_stage_target.py > index 9edafe9..10b367d 100644 > --- a/modules/generic_stage_target.py > +++ b/modules/generic_stage_target.py > @@ -179,13 +179,13 @@ class generic_stage_target(generic_target): > > self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\ > > "/usr/portage":self.settings["snapshot_cache_path"]+"/portage",\ > > "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs", > - "/dev/shm": "/dev/shm"} > + "/dev/shm": "shmfs"} > else: > self.mounts=["/proc", "/dev", > "/usr/portage/distfiles", > "/var/tmp/portage"] > > self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\ > > "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs", > - "/dev/shm": "/dev/shm"} > + "/dev/shm": "shmfs"} > if os.uname()[0] == "Linux": > self.mounts.append("/dev/pts") > self.mounts.append("/dev/shm") > @@ -904,7 +904,7 @@ class generic_stage_target(generic_target): > > os.makedirs(self.settings["chroot_path"]+x,0755) > > if not os.path.exists(self.mountmap[x]): > - if not self.mountmap[x] == "tmpfs": > + if self.mountmap[x] != "tmpfs" and > self.mountmap[x] != "shmfs": > os.makedirs(self.mountmap[x],0755) > > src=self.mountmap[x] > @@ -923,6 +923,9 @@ class generic_stage_target(generic_target): > retval=os.system("mount -t > tmpfs -o size="+\ > > self.settings["var_tmpfs_portage"]+"G "+src+" "+\ > > self.settings["chroot_path"]+x) > + else if src == "shmfs": > + retval=os.system("mount -t tmpfs -o > noexec,nosuid,nodev shm "+\ > + > self.settings["chroot_path"]+x) > else: > retval=os.system("mount --bind > "+src+" "+\ > > self.settings["chroot_path"]+x) > -- > 1.8.4.3 >
Oh, I forgot to mention that this is for 2.X, not master. -Doug
