| 1 |
commit: 1494cb6f62d992f6a3215eaa54607d1b22af888e |
| 2 |
Author: Matt Turner <mattst88 <AT> gentoo <DOT> org> |
| 3 |
AuthorDate: Thu Oct 29 15:00:42 2020 +0000 |
| 4 |
Commit: Matt Turner <mattst88 <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Thu Oct 29 15:34:48 2020 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/proj/catalyst.git/commit/?id=1494cb6f |
| 7 |
|
| 8 |
catalyst: Run the build sequence in new mount namespace |
| 9 |
|
| 10 |
Catalyst has a lot of code to unmount the bind mounts it's made, and |
| 11 |
then more to try harder when something fails. This is important because |
| 12 |
if bind mounts still exist within the chroot when clean up happens, |
| 13 |
files outside of the chroot on the host system can inadvertently be |
| 14 |
deleted. E.g., distfiles and binpkgs. |
| 15 |
|
| 16 |
Running the build sequence (the steps that need bind mounts) within a |
| 17 |
mount namespace and exiting the mount namespace when finished ensures |
| 18 |
that clean up can never accidentally delete files outside the chroot. |
| 19 |
|
| 20 |
Signed-off-by: Matt Turner <mattst88 <AT> gentoo.org> |
| 21 |
|
| 22 |
catalyst/base/stagebase.py | 8 +++++--- |
| 23 |
catalyst/main.py | 2 +- |
| 24 |
2 files changed, 6 insertions(+), 4 deletions(-) |
| 25 |
|
| 26 |
diff --git a/catalyst/base/stagebase.py b/catalyst/base/stagebase.py |
| 27 |
index 829bcc93..defe6f27 100644 |
| 28 |
--- a/catalyst/base/stagebase.py |
| 29 |
+++ b/catalyst/base/stagebase.py |
| 30 |
@@ -15,6 +15,7 @@ from snakeoil.osutils import pjoin |
| 31 |
from DeComp.compress import CompressMap |
| 32 |
|
| 33 |
from catalyst import log |
| 34 |
+from catalyst.context import namespace |
| 35 |
from catalyst.defaults import (confdefaults, MOUNT_DEFAULTS, PORT_LOGDIR_CLEAN) |
| 36 |
from catalyst.support import (CatalystError, file_locate, normpath, |
| 37 |
cmd, read_makeconf, ismount, file_check, |
| 38 |
@@ -1405,9 +1406,10 @@ class StageBase(TargetBase, ClearBase, GenBase): |
| 39 |
if not self.run_sequence(self.prepare_sequence): |
| 40 |
return False |
| 41 |
|
| 42 |
- if not self.run_sequence(self.build_sequence): |
| 43 |
- self.unbind() |
| 44 |
- return False |
| 45 |
+ with namespace(mount=True): |
| 46 |
+ if not self.run_sequence(self.build_sequence): |
| 47 |
+ self.unbind() |
| 48 |
+ return False |
| 49 |
|
| 50 |
if not self.run_sequence(self.finish_sequence): |
| 51 |
return False |
| 52 |
|
| 53 |
diff --git a/catalyst/main.py b/catalyst/main.py |
| 54 |
index 93a4a0d3..5536471a 100644 |
| 55 |
--- a/catalyst/main.py |
| 56 |
+++ b/catalyst/main.py |
| 57 |
@@ -355,7 +355,7 @@ def _main(parser, opts): |
| 58 |
# use pid & user namespaces, but snakeoil's namespace module has signal |
| 59 |
# transfer issues (CTRL+C doesn't propagate), and user namespaces need |
| 60 |
# more work due to Gentoo build process (uses sudo/root/portage). |
| 61 |
- with namespace(mount=True, uts=True, ipc=True, hostname='catalyst'): |
| 62 |
+ with namespace(uts=True, ipc=True, hostname='catalyst'): |
| 63 |
# everything is setup, so the build is a go |
| 64 |
try: |
| 65 |
success = build_target(addlargs) |
Archives