summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
diff options
context:
space:
mode:
authorLuca Boccassi <luca.boccassi@microsoft.com>2022-03-28 16:26:54 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2022-03-29 15:59:29 +0100
commit259c30621f8b2072fc4878c210d2ddadbdea91e1 (patch)
treee7c9c28d16fa1ba61d2477dad0977343bf4d3348 /meta/recipes-core
parent240e5ab3c4e17b476c15078da5b1262b35086d10 (diff)
downloadpoky-259c30621f8b2072fc4878c210d2ddadbdea91e1.tar.gz
volatile-binds: add recipe variable to allow disabling OverlayFS
Use the new MOUNT_COPYBIND_AVOID_OVERLAYFS flag provided by mount-copybind. When SELinux is enabled, processes accessing OverlayFS mounts will get a denial if the process setting up the mount doesn't have all the permissions that the accessor has. (From OE-Core rev: 6002bdc77643c363a8326bf163baecba8b36e3e0) Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core')
-rw-r--r--meta/recipes-core/volatile-binds/files/volatile-binds.service.in1
-rw-r--r--meta/recipes-core/volatile-binds/volatile-binds.bb4
2 files changed, 5 insertions, 0 deletions
diff --git a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
index e2ad39f258..6612d2aae0 100644
--- a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
+++ b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
@@ -11,6 +11,7 @@ ConditionPathIsReadWrite=!@where@
11Type=oneshot 11Type=oneshot
12RemainAfterExit=Yes 12RemainAfterExit=Yes
13TimeoutSec=0 13TimeoutSec=0
14Environment=MOUNT_COPYBIND_AVOID_OVERLAYFS=@avoid_overlayfs@
14ExecStart=/sbin/mount-copybind @what@ @where@ 15ExecStart=/sbin/mount-copybind @what@ @where@
15ExecStop=/bin/umount @where@ 16ExecStop=/bin/umount @where@
16 17
diff --git a/meta/recipes-core/volatile-binds/volatile-binds.bb b/meta/recipes-core/volatile-binds/volatile-binds.bb
index d5c5538cd7..3fefa9abde 100644
--- a/meta/recipes-core/volatile-binds/volatile-binds.bb
+++ b/meta/recipes-core/volatile-binds/volatile-binds.bb
@@ -37,6 +37,9 @@ SYSTEMD_SERVICE:${PN} = "${@volatile_systemd_services(d)}"
37 37
38FILES:${PN} += "${systemd_system_unitdir}/*.service ${servicedir}" 38FILES:${PN} += "${systemd_system_unitdir}/*.service ${servicedir}"
39 39
40# Set to 1 to forcibly skip OverlayFS, and default to copy+bind
41AVOID_OVERLAYFS = "0"
42
40do_compile () { 43do_compile () {
41 while read spec mountpoint; do 44 while read spec mountpoint; do
42 if [ -z "$spec" ]; then 45 if [ -z "$spec" ]; then
@@ -47,6 +50,7 @@ do_compile () {
47 servicefile="$(echo "$servicefile" | tr / -).service" 50 servicefile="$(echo "$servicefile" | tr / -).service"
48 sed -e "s#@what@#$spec#g; s#@where@#$mountpoint#g" \ 51 sed -e "s#@what@#$spec#g; s#@where@#$mountpoint#g" \
49 -e "s#@whatparent@#${spec%/*}#g; s#@whereparent@#${mountpoint%/*}#g" \ 52 -e "s#@whatparent@#${spec%/*}#g; s#@whereparent@#${mountpoint%/*}#g" \
53 -e "s#@avoid_overlayfs@#${@d.getVar('AVOID_OVERLAYFS')}#g" \
50 volatile-binds.service.in >$servicefile 54 volatile-binds.service.in >$servicefile
51 done <<END 55 done <<END
52${@d.getVar('VOLATILE_BINDS').replace("\\n", "\n")} 56${@d.getVar('VOLATILE_BINDS').replace("\\n", "\n")}