3 files changed, 52 insertions, 21 deletions

diff --git a/meta/recipes-core/volatile-binds/files/mount-copybind b/meta/recipes-core/volatile-binds/files/mount-copybind
index e32e675308..ddc4357615 100755
--- a/meta/recipes-core/volatile-binds/files/mount-copybind
+++ b/meta/recipes-core/volatile-binds/files/mount-copybind
@@ -2,6 +2,9 @@
 #
 # Perform a bind mount, copying existing files as we do so to ensure the
 # overlaid path has the necessary content.
+# If the target is a directory and overlayfs is available (and the environment
+# variable MOUNT_COPYBIND_AVOID_OVERLAYFS=1 is not set), then an overlay mount
+# will be attempted first.
 
 if [ $# -lt 2 ]; then
     echo >&2 "Usage: $0 spec mountpoint [OPTIONS]"
@@ -31,6 +34,13 @@ if [ -d "$mountpoint" ]; then
     else
         specdir_existed=no
         mkdir "$spec"
+        # If the $spec directory is created we need to take care that
+        # the selinux context is correct
+        if command -v selinuxenabled > /dev/null 2>&1; then
+            if selinuxenabled; then
+                restorecon "$spec"
+            fi
+        fi
     fi
 
     # Fast version of calculating `dirname ${spec}`/.`basename ${spec}`-work
@@ -39,13 +49,24 @@ if [ -d "$mountpoint" ]; then
 
     # Try to mount using overlay, which is must faster than copying files.
     # If that fails, fall back to slower copy.
-    if ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir" "$mountpoint" > /dev/null 2>&1; then
+    if command -v selinuxenabled > /dev/null 2>&1; then
+        if selinuxenabled; then
+            mountcontext=",rootcontext=$(matchpathcon -n "$mountpoint")"
+        fi
+    fi
+    if [ "$MOUNT_COPYBIND_AVOID_OVERLAYFS" = 1 ] || ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir""$mountcontext" "$mountpoint" > /dev/null 2>&1; then
 
         if [ "$specdir_existed" != "yes" ]; then
             cp -aPR "$mountpoint"/. "$spec/"
         fi
 
         mount -o "bind$options" "$spec" "$mountpoint"
+        # restore the selinux context.
+        if command -v selinuxenabled > /dev/null 2>&1; then
+            if selinuxenabled; then
+                restorecon -R "$mountpoint"
+            fi
+        fi
     fi
 elif [ -f "$mountpoint" ]; then
     if [ ! -f "$spec" ]; then
@@ -53,4 +74,10 @@ elif [ -f "$mountpoint" ]; then
     fi
 
     mount -o "bind$options" "$spec" "$mountpoint"
+    # restore the selinux context.
+    if command -v selinuxenabled > /dev/null 2>&1; then
+        if selinuxenabled; then
+            restorecon -R "$mountpoint"
+        fi
+    fi
 fi
diff --git a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
index e2ad39f258..5a0055bec3 100644
--- a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
+++ b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
@@ -1,16 +1,17 @@
 [Unit]
 Description=Bind mount volatile @where@
-DefaultDependencies=false
+DefaultDependencies=no
 Before=local-fs.target
 RequiresMountsFor=@whatparent@ @whereparent@
-ConditionPathIsReadWrite=@whatparent@
+ConditionPathIsReadWrite=|@whatparent@
+ConditionPathExists=|!@whatparent@
 ConditionPathExists=@where@
 ConditionPathIsReadWrite=!@where@
 
 [Service]
 Type=oneshot
 RemainAfterExit=Yes
-TimeoutSec=0
+Environment=MOUNT_COPYBIND_AVOID_OVERLAYFS=@avoid_overlayfs@
 ExecStart=/sbin/mount-copybind @what@ @where@
 ExecStop=/bin/umount @where@
 
diff --git a/meta/recipes-core/volatile-binds/volatile-binds.bb b/meta/recipes-core/volatile-binds/volatile-binds.bb
index 3c8b18291e..3597ec7356 100644
--- a/meta/recipes-core/volatile-binds/volatile-binds.bb
+++ b/meta/recipes-core/volatile-binds/volatile-binds.bb
@@ -9,17 +9,18 @@ SRC_URI = "\
     file://volatile-binds.service.in \
 "
 
-S = "${WORKDIR}"
+S = "${WORKDIR}/sources"
+UNPACKDIR = "${S}"
 
 inherit allarch systemd features_check
 
 REQUIRED_DISTRO_FEATURES = "systemd"
 
 VOLATILE_BINDS ?= "\
-    /var/volatile/lib /var/lib\n\
-    /var/volatile/cache /var/cache\n\
-    /var/volatile/spool /var/spool\n\
-    /var/volatile/srv /srv\n\
+    ${localstatedir}/volatile/lib ${localstatedir}/lib\n\
+    ${localstatedir}/volatile/cache ${localstatedir}/cache\n\
+    ${localstatedir}/volatile/spool ${localstatedir}/spool\n\
+    ${localstatedir}/volatile/srv /srv\n\
 "
 VOLATILE_BINDS[type] = "list"
 VOLATILE_BINDS[separator] = "\n"
@@ -33,9 +34,12 @@ def volatile_systemd_services(d):
         services.append("%s.service" % what[1:].replace("/", "-"))
     return " ".join(services)
 
-SYSTEMD_SERVICE_${PN} = "${@volatile_systemd_services(d)}"
+SYSTEMD_SERVICE:${PN} = "${@volatile_systemd_services(d)}"
 
-FILES_${PN} += "${systemd_unitdir}/system/*.service ${servicedir}"
+FILES:${PN} += "${systemd_system_unitdir}/*.service ${servicedir}"
+
+# Set to 1 to forcibly skip OverlayFS, and default to copy+bind
+AVOID_OVERLAYFS = "0"
 
 do_compile () {
     while read spec mountpoint; do
@@ -43,39 +47,38 @@ do_compile () {
             continue
         fi
 
-        servicefile="${spec#/}"
-        servicefile="$(echo "$servicefile" | tr / -).service"
+        servicefile="$(echo "${spec#/}" | tr / -).service"
+        [ "$mountpoint" != ${localstatedir}/lib ] || var_lib_servicefile=$servicefile
         sed -e "s#@what@#$spec#g; s#@where@#$mountpoint#g" \
             -e "s#@whatparent@#${spec%/*}#g; s#@whereparent@#${mountpoint%/*}#g" \
+            -e "s#@avoid_overlayfs@#${@d.getVar('AVOID_OVERLAYFS')}#g" \
             volatile-binds.service.in >$servicefile
     done <<END
 ${@d.getVar('VOLATILE_BINDS').replace("\\n", "\n")}
 END
 
-    if [ -e var-volatile-lib.service ]; then
+    if [ -e "$var_lib_servicefile" ]; then
         # As the seed is stored under /var/lib, ensure that this service runs
         # after the volatile /var/lib is mounted.
         sed -i -e "/^Before=/s/\$/ systemd-random-seed.service/" \
                -e "/^WantedBy=/s/\$/ systemd-random-seed.service/" \
-               var-volatile-lib.service
+               "$var_lib_servicefile"
     fi
 }
-do_compile[dirs] = "${WORKDIR}"
 
 do_install () {
     install -d ${D}${base_sbindir}
     install -d ${D}${servicedir}
     install -m 0755 mount-copybind ${D}${base_sbindir}/
 
-    install -d ${D}${systemd_unitdir}/system
-    for service in ${SYSTEMD_SERVICE_${PN}}; do
-        install -m 0644 $service ${D}${systemd_unitdir}/system/
+    install -d ${D}${systemd_system_unitdir}
+    for service in ${SYSTEMD_SERVICE:${PN}}; do
+        install -m 0644 $service ${D}${systemd_system_unitdir}/
     done
 
     # Suppress attempts to process some tmpfiles that are not temporary.
     #
-    install -d ${D}${sysconfdir}/tmpfiles.d ${D}/var/cache
+    install -d ${D}${sysconfdir}/tmpfiles.d ${D}${localstatedir}/cache
     ln -s /dev/null ${D}${sysconfdir}/tmpfiles.d/etc.conf
     ln -s /dev/null ${D}${sysconfdir}/tmpfiles.d/home.conf
 }
-do_install[dirs] = "${WORKDIR}"