diff options
| author |   Luca Boccassi <luca.boccassi@microsoft.com> | 2022-03-28 16:26:54 +0100 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-03-29 15:58:39 +0100 |
| commit | 6002bdc77643c363a8326bf163baecba8b36e3e0 (patch) | |
| tree | 520d7a8ade4f74d6ef250a8f559b127f7c4abab1 | |
| parent | b0f8d8a4c063936b50d3ec7c066b29157b3c3544 (diff) | |
| download | openembedded-core-contrib-6002bdc77643c363a8326bf163baecba8b36e3e0.tar.gz | |
volatile-binds: add recipe variable to allow disabling OverlayFS
Use the new MOUNT_COPYBIND_AVOID_OVERLAYFS flag provided by mount-copybind.
When SELinux is enabled, processes accessing OverlayFS mounts will get a denial
if the process setting up the mount doesn't have all the permissions that
the accessor has.
Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
| -rw-r--r-- | meta/recipes-core/volatile-binds/files/volatile-binds.service.in | 1 | ||||
| -rw-r--r-- | meta/recipes-core/volatile-binds/volatile-binds.bb | 4 |
2 files changed, 5 insertions, 0 deletions
diff --git a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in index e2ad39f258..6612d2aae0 100644 --- a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in +++ b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in @@ -11,6 +11,7 @@ ConditionPathIsReadWrite=!@where@ Type=oneshot RemainAfterExit=Yes TimeoutSec=0 +Environment=MOUNT_COPYBIND_AVOID_OVERLAYFS=@avoid_overlayfs@ ExecStart=/sbin/mount-copybind @what@ @where@ ExecStop=/bin/umount @where@ diff --git a/meta/recipes-core/volatile-binds/volatile-binds.bb b/meta/recipes-core/volatile-binds/volatile-binds.bb index d5c5538cd7..3fefa9abde 100644 --- a/meta/recipes-core/volatile-binds/volatile-binds.bb +++ b/meta/recipes-core/volatile-binds/volatile-binds.bb @@ -37,6 +37,9 @@ SYSTEMD_SERVICE:${PN} = "${@volatile_systemd_services(d)}" FILES:${PN} += "${systemd_system_unitdir}/*.service ${servicedir}" +# Set to 1 to forcibly skip OverlayFS, and default to copy+bind +AVOID_OVERLAYFS = "0" + do_compile () { while read spec mountpoint; do if [ -z "$spec" ]; then @@ -47,6 +50,7 @@ do_compile () { servicefile="$(echo "$servicefile" | tr / -).service" sed -e "s#@what@#$spec#g; s#@where@#$mountpoint#g" \ -e "s#@whatparent@#${spec%/*}#g; s#@whereparent@#${mountpoint%/*}#g" \ + -e "s#@avoid_overlayfs@#${@d.getVar('AVOID_OVERLAYFS')}#g" \ volatile-binds.service.in >$servicefile done <<END ${@d.getVar('VOLATILE_BINDS').replace("\\n", "\n")} |