public inbox for gentoo-catalyst@lists.gentoo.org
 help / color / mirror / Atom feed
From: Matt Turner <mattst88@gentoo.org>
To: gentoo-catalyst@lists.gentoo.org
Cc: Matt Turner <mattst88@gentoo.org>
Subject: [gentoo-catalyst] [PATCH 09/12] catalyst: Run the build sequence in new mount namespace
Date: Thu, 29 Oct 2020 12:16:29 -0400	[thread overview]
Message-ID: <20201029161632.146732-9-mattst88@gentoo.org> (raw)
In-Reply-To: <20201029161632.146732-1-mattst88@gentoo.org>

Catalyst has a lot of code to unmount the bind mounts it's made, and
then more to try harder when something fails. This is important because
if bind mounts still exist within the chroot when clean up happens,
files outside of the chroot on the host system can inadvertently be
deleted. E.g., distfiles, binpkgs, kerncache.

Running the build sequence (the steps that need bind mounts) within a
mount namespace and exiting the mount namespace when finished ensures
that clean up can never accidentally delete files outside the chroot.

Signed-off-by: Matt Turner <mattst88@gentoo.org>
---
 catalyst/base/stagebase.py | 8 +++++---
 catalyst/main.py           | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/catalyst/base/stagebase.py b/catalyst/base/stagebase.py
index 06ec8727..ec9a8f06 100644
--- a/catalyst/base/stagebase.py
+++ b/catalyst/base/stagebase.py
@@ -15,6 +15,7 @@ from snakeoil.osutils import pjoin
 from DeComp.compress import CompressMap
 
 from catalyst import log
+from catalyst.context import namespace
 from catalyst.defaults import (confdefaults, MOUNT_DEFAULTS, PORT_LOGDIR_CLEAN)
 from catalyst.support import (CatalystError, file_locate, normpath,
                               cmd, read_makeconf, ismount, file_check,
@@ -1405,9 +1406,10 @@ class StageBase(TargetBase, ClearBase, GenBase):
         if not self.run_sequence(self.prepare_sequence):
             return False
 
-        if not self.run_sequence(self.build_sequence):
-            self.unbind()
-            return False
+        with namespace(mount=True):
+            if not self.run_sequence(self.build_sequence):
+                self.unbind()
+                return False
 
         if not self.run_sequence(self.finish_sequence):
             return False
diff --git a/catalyst/main.py b/catalyst/main.py
index 93a4a0d3..5536471a 100644
--- a/catalyst/main.py
+++ b/catalyst/main.py
@@ -355,7 +355,7 @@ def _main(parser, opts):
     # use pid & user namespaces, but snakeoil's namespace module has signal
     # transfer issues (CTRL+C doesn't propagate), and user namespaces need
     # more work due to Gentoo build process (uses sudo/root/portage).
-    with namespace(mount=True, uts=True, ipc=True, hostname='catalyst'):
+    with namespace(uts=True, ipc=True, hostname='catalyst'):
         # everything is setup, so the build is a go
         try:
             success = build_target(addlargs)
-- 
2.26.2



  parent reply	other threads:[~2020-10-29 16:16 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-29 16:16 [gentoo-catalyst] [PATCH 01/12] catalyst: Replace pathcompare() Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 02/12] catalyst: Rewrite ismount() to use libmount Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 03/12] catalyst: Use libmount for handling mounts Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 04/12] catalyst: Move action_sequence out of self.settings[] Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 05/12] catalyst: Use .extend() and .append() for action_sequence Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 06/12] catalyst: Split action_sequence into prepare/build/finish Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 07/12] catalyst: Factor out run_sequence() Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 08/12] catalyst: Add and use namespace context manager Matt Turner
2020-10-29 16:16 ` Matt Turner [this message]
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 10/12] catalyst: Remove kill_support_pids() Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 11/12] catalyst: Remove mount_safety_check() Matt Turner
2020-10-29 16:16 ` [gentoo-catalyst] [PATCH 12/12] catalyst: Drop unbind() Matt Turner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201029161632.146732-9-mattst88@gentoo.org \
    --to=mattst88@gentoo.org \
    --cc=gentoo-catalyst@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox