Gentoo Archives: gentoo-catalyst

From: Douglas Freed <dwfreed@×××.edu>
To: gentoo-catalyst@l.g.o
Cc: Douglas Freed <dwfreed@×××.edu>
Subject: [gentoo-catalyst] [PATCH] Mount /dev/shm in the chroot with the right options
Date: Wed, 01 Jan 2014 21:19:16
Message-Id: 1388611102-11734-1-git-send-email-dwfreed@mtu.edu
1 Bind mounting /dev/shm into the chroot isn't a good idea, as there may
2 be collisions and result in weird side effects. Instead, we can just
3 mount a new tmpfs there, with the right options to ensure security.
4 ---
5 modules/generic_stage_target.py | 9 ++++++---
6 1 file changed, 6 insertions(+), 3 deletions(-)
7
8 diff --git a/modules/generic_stage_target.py b/modules/generic_stage_target.py
9 index 9edafe9..10b367d 100644
10 --- a/modules/generic_stage_target.py
11 +++ b/modules/generic_stage_target.py
12 @@ -179,13 +179,13 @@ class generic_stage_target(generic_target):
13 self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\
14 "/usr/portage":self.settings["snapshot_cache_path"]+"/portage",\
15 "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs",
16 - "/dev/shm": "/dev/shm"}
17 + "/dev/shm": "shmfs"}
18 else:
19 self.mounts=["/proc", "/dev", "/usr/portage/distfiles",
20 "/var/tmp/portage"]
21 self.mountmap={"/proc":"/proc","/dev":"/dev","/dev/pts":"/dev/pts",\
22 "/usr/portage/distfiles":self.settings["distdir"],"/var/tmp/portage":"tmpfs",
23 - "/dev/shm": "/dev/shm"}
24 + "/dev/shm": "shmfs"}
25 if os.uname()[0] == "Linux":
26 self.mounts.append("/dev/pts")
27 self.mounts.append("/dev/shm")
28 @@ -904,7 +904,7 @@ class generic_stage_target(generic_target):
29 os.makedirs(self.settings["chroot_path"]+x,0755)
30
31 if not os.path.exists(self.mountmap[x]):
32 - if not self.mountmap[x] == "tmpfs":
33 + if self.mountmap[x] != "tmpfs" and self.mountmap[x] != "shmfs":
34 os.makedirs(self.mountmap[x],0755)
35
36 src=self.mountmap[x]
37 @@ -923,6 +923,9 @@ class generic_stage_target(generic_target):
38 retval=os.system("mount -t tmpfs -o size="+\
39 self.settings["var_tmpfs_portage"]+"G "+src+" "+\
40 self.settings["chroot_path"]+x)
41 + else if src == "shmfs":
42 + retval=os.system("mount -t tmpfs -o noexec,nosuid,nodev shm "+\
43 + self.settings["chroot_path"]+x)
44 else:
45 retval=os.system("mount --bind "+src+" "+\
46 self.settings["chroot_path"]+x)
47 --
48 1.8.4.3

Replies