From: Douglas Freed <dwfreed@mtu.edu>
To: gentoo-catalyst@lists.gentoo.org
Subject: [gentoo-catalyst] Re: [PATCH] Mount /dev/shm in the chroot with the right options
Date: Wed, 1 Jan 2014 13:22:44 -0800 [thread overview]
Message-ID: <CAFyXEpJ6PAabpUmc3DxEJUB+wgFgSHScdcUhO8byU+qydoWjCg@mail.gmail.com> (raw)
In-Reply-To: <1388611102-11734-1-git-send-email-dwfreed@mtu.edu>
On Wed, Jan 1, 2014 at 1:18 PM, Douglas Freed <dwfreed@mtu.edu> wrote:
> Bind mounting /dev/shm into the chroot isn't a good idea, as there may
> be collisions and result in weird side effects. Instead, we can just
> mount a new tmpfs there, with the right options to ensure security.
> ---
> modules/generic_stage_target.py | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/modules/generic_stage_target.py b/modules/generic_stage_target.py
> index 9edafe9..10b367d 100644
> --- a/modules/generic_stage_target.py
> +++ b/modules/generic_stage_target.py
> @@ -179,13 +179,13 @@ class generic_stage_target(generic_target):
> self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\
> "/usr/portage":self.settings["snapshot_cache_path"]+"/portage",\
> "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs",
> - "/dev/shm": "/dev/shm"}
> + "/dev/shm": "shmfs"}
> else:
> self.mounts=["/proc", "/dev", "/usr/portage/distfiles",
> "/var/tmp/portage"]
> self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\
> "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs",
> - "/dev/shm": "/dev/shm"}
> + "/dev/shm": "shmfs"}
> if os.uname()[0] == "Linux":
> self.mounts.append("/dev/pts")
> self.mounts.append("/dev/shm")
> @@ -904,7 +904,7 @@ class generic_stage_target(generic_target):
> os.makedirs(self.settings["chroot_path"]+x,0755)
>
> if not os.path.exists(self.mountmap[x]):
> - if not self.mountmap[x] == "tmpfs":
> + if self.mountmap[x] != "tmpfs" and self.mountmap[x] != "shmfs":
> os.makedirs(self.mountmap[x],0755)
>
> src=self.mountmap[x]
> @@ -923,6 +923,9 @@ class generic_stage_target(generic_target):
> retval=os.system("mount -t tmpfs -o size="+\
> self.settings["var_tmpfs_portage"]+"G "+src+" "+\
> self.settings["chroot_path"]+x)
> + else if src == "shmfs":
> + retval=os.system("mount -t tmpfs -o noexec,nosuid,nodev shm "+\
> + self.settings["chroot_path"]+x)
> else:
> retval=os.system("mount --bind "+src+" "+\
> self.settings["chroot_path"]+x)
> --
> 1.8.4.3
>
Oh, I forgot to mention that this is for 2.X, not master.
-Doug
next prev parent reply other threads:[~2014-01-01 21:22 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-01 21:18 [gentoo-catalyst] [PATCH] Mount /dev/shm in the chroot with the right options Douglas Freed
2014-01-01 21:22 ` Douglas Freed [this message]
2014-01-01 21:30 ` W. Trevor King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFyXEpJ6PAabpUmc3DxEJUB+wgFgSHScdcUhO8byU+qydoWjCg@mail.gmail.com \
--to=dwfreed@mtu.edu \
--cc=gentoo-catalyst@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox