1 |
Bind mounting /dev/shm into the chroot isn't a good idea, as there may |
2 |
be collisions and result in weird side effects. Instead, we can just |
3 |
mount a new tmpfs there, with the right options to ensure security. |
4 |
--- |
5 |
modules/generic_stage_target.py | 9 ++++++--- |
6 |
1 file changed, 6 insertions(+), 3 deletions(-) |
7 |
|
8 |
diff --git a/modules/generic_stage_target.py b/modules/generic_stage_target.py |
9 |
index 9edafe9..10b367d 100644 |
10 |
--- a/modules/generic_stage_target.py |
11 |
+++ b/modules/generic_stage_target.py |
12 |
@@ -179,13 +179,13 @@ class generic_stage_target(generic_target): |
13 |
self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\ |
14 |
"/usr/portage":self.settings["snapshot_cache_path"]+"/portage",\ |
15 |
"/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs", |
16 |
- "/dev/shm": "/dev/shm"} |
17 |
+ "/dev/shm": "shmfs"} |
18 |
else: |
19 |
self.mounts=["/proc", "/dev", "/usr/portage/distfiles", |
20 |
"/var/tmp/portage"] |
21 |
self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\ |
22 |
"/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs", |
23 |
- "/dev/shm": "/dev/shm"} |
24 |
+ "/dev/shm": "shmfs"} |
25 |
if os.uname()[0] == "Linux": |
26 |
self.mounts.append("/dev/pts") |
27 |
self.mounts.append("/dev/shm") |
28 |
@@ -904,7 +904,7 @@ class generic_stage_target(generic_target): |
29 |
os.makedirs(self.settings["chroot_path"]+x,0755) |
30 |
|
31 |
if not os.path.exists(self.mountmap[x]): |
32 |
- if not self.mountmap[x] == "tmpfs": |
33 |
+ if self.mountmap[x] != "tmpfs" and self.mountmap[x] != "shmfs": |
34 |
os.makedirs(self.mountmap[x],0755) |
35 |
|
36 |
src=self.mountmap[x] |
37 |
@@ -923,6 +923,9 @@ class generic_stage_target(generic_target): |
38 |
retval=os.system("mount -t tmpfs -o size="+\ |
39 |
self.settings["var_tmpfs_portage"]+"G "+src+" "+\ |
40 |
self.settings["chroot_path"]+x) |
41 |
+ else if src == "shmfs": |
42 |
+ retval=os.system("mount -t tmpfs -o noexec,nosuid,nodev shm "+\ |
43 |
+ self.settings["chroot_path"]+x) |
44 |
else: |
45 |
retval=os.system("mount --bind "+src+" "+\ |
46 |
self.settings["chroot_path"]+x) |
47 |
-- |
48 |
1.8.4.3 |