On Wed, Jan 01, 2014 at 09:18:22PM +0000, Douglas Freed wrote:
> Bind mounting /dev/shm into the chroot isn't a good idea, as there may
> be collisions and result in weird side effects. Instead, we can just
> mount a new tmpfs there, with the right options to ensure security.
> ---
> modules/generic_stage_target.py | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/modules/generic_stage_target.py b/modules/generic_stage_target.py
> index 9edafe9..10b367d 100644
> --- a/modules/generic_stage_target.py
> +++ b/modules/generic_stage_target.py
> @@ -179,13 +179,13 @@ class generic_stage_target(generic_target):
>
> self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\
>
> "/usr/portage":self.settings["snapshot_cache_path"]+"/portage",\
>
> "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs",
> - "/dev/shm": "/dev/shm"}
> + "/dev/shm": "shmfs"}
> else:
> self.mounts=["/proc", "/dev", "/usr/portage/distfiles",
> "/var/tmp/portage"]
>
> self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\
>
> "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs",
> - "/dev/shm": "/dev/shm"}
> + "/dev/shm": "shmfs"}
> if os.uname()[0] == "Linux":
> self.mounts.append("/dev/pts")
> self.mounts.append("/dev/shm")
> @@ -904,7 +904,7 @@ class generic_stage_target(generic_target):
> os.makedirs(self.settings["chroot_path"]+x,0755)
>
> if not os.path.exists(self.mountmap[x]):
> - if not self.mountmap[x] == "tmpfs":
> + if self.mountmap[x] != "tmpfs" and
> self.mountmap[x] != "shmfs":
> os.makedirs(self.mountmap[x],0755)
>
> src=self.mountmap[x]
> @@ -923,6 +923,9 @@ class generic_stage_target(generic_target):
> retval=os.system("mount -t
> tmpfs -o size="+\
>
> self.settings["var_tmpfs_portage"]+"G "+src+" "+\
>
> self.settings["chroot_path"]+x)
> + else if src == "shmfs":
> + retval=os.system("mount -t tmpfs -o
> noexec,nosuid,nodev shm "+\
> + self.settings["chroot_path"]+x)
> else:
> retval=os.system("mount --bind "+src+"
> "+\
> self.settings["chroot_path"]+x)Looks good enough to me. Are we forward-porting this onto blueness' pending patch? I'll wait until more of the pending branch has been absorbed into master before working up a more thorough patch to support user-configurable: * '--bind $SOURCE' vs. '--rbind $SOURCE' vs. '-t $TYPE' * '-o $OPTIONS' Which will take care of my --rbind goals [1] in a more flexible way. Cheers, Trevor [1]: http://mid.gmane.org/[email protected] -- This email may be signed or encrypted with GnuPG (http://www.gnupg.org). For more information, see http://en.wikipedia.org/wiki/Pretty_Good_Privacy
signature.asc
Description: OpenPGP digital signature
