public inbox for gentoo-catalyst@lists.gentoo.org
 help / color / mirror / Atom feed
From: Douglas Freed <dwfreed@mtu.edu>
To: gentoo-catalyst@lists.gentoo.org
Subject: [gentoo-catalyst] Re: [PATCH] Mount /dev/shm in the chroot with the right options
Date: Wed, 1 Jan 2014 13:22:44 -0800	[thread overview]
Message-ID: <CAFyXEpJ6PAabpUmc3DxEJUB+wgFgSHScdcUhO8byU+qydoWjCg@mail.gmail.com> (raw)
In-Reply-To: <1388611102-11734-1-git-send-email-dwfreed@mtu.edu>

On Wed, Jan 1, 2014 at 1:18 PM, Douglas Freed <dwfreed@mtu.edu> wrote:
> Bind mounting /dev/shm into the chroot isn't a good idea, as there may
> be collisions and result in weird side effects.  Instead, we can just
> mount a new tmpfs there, with the right options to ensure security.
> ---
>  modules/generic_stage_target.py | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/modules/generic_stage_target.py b/modules/generic_stage_target.py
> index 9edafe9..10b367d 100644
> --- a/modules/generic_stage_target.py
> +++ b/modules/generic_stage_target.py
> @@ -179,13 +179,13 @@ class generic_stage_target(generic_target):
>                         self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\
>                                 "/usr/portage":self.settings["snapshot_cache_path"]+"/portage",\
>                                 "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs",
> -                               "/dev/shm": "/dev/shm"}
> +                               "/dev/shm": "shmfs"}
>                 else:
>                         self.mounts=["/proc", "/dev", "/usr/portage/distfiles",
>                                 "/var/tmp/portage"]
>                         self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\
>                                 "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs",
> -                               "/dev/shm": "/dev/shm"}
> +                               "/dev/shm": "shmfs"}
>                 if os.uname()[0] == "Linux":
>                         self.mounts.append("/dev/pts")
>                         self.mounts.append("/dev/shm")
> @@ -904,7 +904,7 @@ class generic_stage_target(generic_target):
>                                 os.makedirs(self.settings["chroot_path"]+x,0755)
>
>                         if not os.path.exists(self.mountmap[x]):
> -                               if not self.mountmap[x] == "tmpfs":
> +                               if self.mountmap[x] != "tmpfs" and self.mountmap[x] != "shmfs":
>                                         os.makedirs(self.mountmap[x],0755)
>
>                         src=self.mountmap[x]
> @@ -923,6 +923,9 @@ class generic_stage_target(generic_target):
>                                                 retval=os.system("mount -t tmpfs -o size="+\
>                                                         self.settings["var_tmpfs_portage"]+"G "+src+" "+\
>                                                         self.settings["chroot_path"]+x)
> +                               else if src == "shmfs":
> +                                       retval=os.system("mount -t tmpfs -o noexec,nosuid,nodev shm "+\
> +                                               self.settings["chroot_path"]+x)
>                                 else:
>                                         retval=os.system("mount --bind "+src+" "+\
>                                                 self.settings["chroot_path"]+x)
> --
> 1.8.4.3
>

Oh, I forgot to mention that this is for 2.X, not master.

-Doug


  reply	other threads:[~2014-01-01 21:22 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-01-01 21:18 [gentoo-catalyst] [PATCH] Mount /dev/shm in the chroot with the right options Douglas Freed
2014-01-01 21:22 ` Douglas Freed [this message]
2014-01-01 21:30 ` W. Trevor King

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAFyXEpJ6PAabpUmc3DxEJUB+wgFgSHScdcUhO8byU+qydoWjCg@mail.gmail.com \
    --to=dwfreed@mtu.edu \
    --cc=gentoo-catalyst@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox