From 6002bdc77643c363a8326bf163baecba8b36e3e0 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@microsoft.com>
Date: Mon, 28 Mar 2022 16:26:54 +0100
Subject: volatile-binds: add recipe variable to allow disabling OverlayFS

Use the new MOUNT_COPYBIND_AVOID_OVERLAYFS flag provided by mount-copybind.
When SELinux is enabled, processes accessing OverlayFS mounts will get a denial
if the process setting up the mount doesn't have all the permissions that
the accessor has.

Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 meta/recipes-core/volatile-binds/files/volatile-binds.service.in | 1 +
 meta/recipes-core/volatile-binds/volatile-binds.bb               | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
index e2ad39f258..6612d2aae0 100644
--- a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
+++ b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
@@ -11,6 +11,7 @@ ConditionPathIsReadWrite=!@where@
 Type=oneshot
 RemainAfterExit=Yes
 TimeoutSec=0
+Environment=MOUNT_COPYBIND_AVOID_OVERLAYFS=@avoid_overlayfs@
 ExecStart=/sbin/mount-copybind @what@ @where@
 ExecStop=/bin/umount @where@
 
diff --git a/meta/recipes-core/volatile-binds/volatile-binds.bb b/meta/recipes-core/volatile-binds/volatile-binds.bb
index d5c5538cd7..3fefa9abde 100644
--- a/meta/recipes-core/volatile-binds/volatile-binds.bb
+++ b/meta/recipes-core/volatile-binds/volatile-binds.bb
@@ -37,6 +37,9 @@ SYSTEMD_SERVICE:${PN} = "${@volatile_systemd_services(d)}"
 
 FILES:${PN} += "${systemd_system_unitdir}/*.service ${servicedir}"
 
+# Set to 1 to forcibly skip OverlayFS, and default to copy+bind
+AVOID_OVERLAYFS = "0"
+
 do_compile () {
     while read spec mountpoint; do
         if [ -z "$spec" ]; then
@@ -47,6 +50,7 @@ do_compile () {
         servicefile="$(echo "$servicefile" | tr / -).service"
         sed -e "s#@what@#$spec#g; s#@where@#$mountpoint#g" \
             -e "s#@whatparent@#${spec%/*}#g; s#@whereparent@#${mountpoint%/*}#g" \
+            -e "s#@avoid_overlayfs@#${@d.getVar('AVOID_OVERLAYFS')}#g" \
             volatile-binds.service.in >$servicefile
     done <<END
 ${@d.getVar('VOLATILE_BINDS').replace("\\n", "\n")}
-- 
cgit 1.2.3-korg