From 259c30621f8b2072fc4878c210d2ddadbdea91e1 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Mon, 28 Mar 2022 16:26:54 +0100 Subject: volatile-binds: add recipe variable to allow disabling OverlayFS Use the new MOUNT_COPYBIND_AVOID_OVERLAYFS flag provided by mount-copybind. When SELinux is enabled, processes accessing OverlayFS mounts will get a denial if the process setting up the mount doesn't have all the permissions that the accessor has. (From OE-Core rev: 6002bdc77643c363a8326bf163baecba8b36e3e0) Signed-off-by: Luca Boccassi Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie --- meta/recipes-core/volatile-binds/files/volatile-binds.service.in | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-core/volatile-binds/files') diff --git a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in index e2ad39f258..6612d2aae0 100644 --- a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in +++ b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in @@ -11,6 +11,7 @@ ConditionPathIsReadWrite=!@where@ Type=oneshot RemainAfterExit=Yes TimeoutSec=0 +Environment=MOUNT_COPYBIND_AVOID_OVERLAYFS=@avoid_overlayfs@ ExecStart=/sbin/mount-copybind @what@ @where@ ExecStop=/bin/umount @where@ -- cgit v1.2.3-54-g00ecf