diff options
Diffstat (limited to 'meta/recipes-core/volatile-binds')
3 files changed, 51 insertions, 19 deletions
diff --git a/meta/recipes-core/volatile-binds/files/mount-copybind b/meta/recipes-core/volatile-binds/files/mount-copybind index e32e675308..ddc4357615 100755 --- a/meta/recipes-core/volatile-binds/files/mount-copybind +++ b/meta/recipes-core/volatile-binds/files/mount-copybind @@ -2,6 +2,9 @@ # # Perform a bind mount, copying existing files as we do so to ensure the # overlaid path has the necessary content. +# If the target is a directory and overlayfs is available (and the environment +# variable MOUNT_COPYBIND_AVOID_OVERLAYFS=1 is not set), then an overlay mount +# will be attempted first. if [ $# -lt 2 ]; then echo >&2 "Usage: $0 spec mountpoint [OPTIONS]" @@ -31,6 +34,13 @@ if [ -d "$mountpoint" ]; then else specdir_existed=no mkdir "$spec" + # If the $spec directory is created we need to take care that + # the selinux context is correct + if command -v selinuxenabled > /dev/null 2>&1; then + if selinuxenabled; then + restorecon "$spec" + fi + fi fi # Fast version of calculating `dirname ${spec}`/.`basename ${spec}`-work @@ -39,13 +49,24 @@ if [ -d "$mountpoint" ]; then # Try to mount using overlay, which is must faster than copying files. # If that fails, fall back to slower copy. - if ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir" "$mountpoint" > /dev/null 2>&1; then + if command -v selinuxenabled > /dev/null 2>&1; then + if selinuxenabled; then + mountcontext=",rootcontext=$(matchpathcon -n "$mountpoint")" + fi + fi + if [ "$MOUNT_COPYBIND_AVOID_OVERLAYFS" = 1 ] || ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir""$mountcontext" "$mountpoint" > /dev/null 2>&1; then if [ "$specdir_existed" != "yes" ]; then cp -aPR "$mountpoint"/. "$spec/" fi mount -o "bind$options" "$spec" "$mountpoint" + # restore the selinux context. + if command -v selinuxenabled > /dev/null 2>&1; then + if selinuxenabled; then + restorecon -R "$mountpoint" + fi + fi fi elif [ -f "$mountpoint" ]; then if [ ! -f "$spec" ]; then @@ -53,4 +74,10 @@ elif [ -f "$mountpoint" ]; then fi mount -o "bind$options" "$spec" "$mountpoint" + # restore the selinux context. + if command -v selinuxenabled > /dev/null 2>&1; then + if selinuxenabled; then + restorecon -R "$mountpoint" + fi + fi fi diff --git a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in index b23355a714..5a0055bec3 100644 --- a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in +++ b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in @@ -1,17 +1,17 @@ [Unit] Description=Bind mount volatile @where@ -DefaultDependencies=false +DefaultDependencies=no Before=local-fs.target RequiresMountsFor=@whatparent@ @whereparent@ -ConditionPathIsReadWrite=@whatparent@ +ConditionPathIsReadWrite=|@whatparent@ +ConditionPathExists=|!@whatparent@ ConditionPathExists=@where@ ConditionPathIsReadWrite=!@where@ [Service] Type=oneshot RemainAfterExit=Yes -StandardOutput=syslog -TimeoutSec=0 +Environment=MOUNT_COPYBIND_AVOID_OVERLAYFS=@avoid_overlayfs@ ExecStart=/sbin/mount-copybind @what@ @where@ ExecStop=/bin/umount @where@ diff --git a/meta/recipes-core/volatile-binds/volatile-binds.bb b/meta/recipes-core/volatile-binds/volatile-binds.bb index b273293e9a..cca8a65fb4 100644 --- a/meta/recipes-core/volatile-binds/volatile-binds.bb +++ b/meta/recipes-core/volatile-binds/volatile-binds.bb @@ -16,10 +16,10 @@ inherit allarch systemd features_check REQUIRED_DISTRO_FEATURES = "systemd" VOLATILE_BINDS ?= "\ - /var/volatile/lib /var/lib\n\ - /var/volatile/cache /var/cache\n\ - /var/volatile/spool /var/spool\n\ - /var/volatile/srv /srv\n\ + ${localstatedir}/volatile/lib ${localstatedir}/lib\n\ + ${localstatedir}/volatile/cache ${localstatedir}/cache\n\ + ${localstatedir}/volatile/spool ${localstatedir}/spool\n\ + ${localstatedir}/volatile/srv /srv\n\ " VOLATILE_BINDS[type] = "list" VOLATILE_BINDS[separator] = "\n" @@ -33,9 +33,12 @@ def volatile_systemd_services(d): services.append("%s.service" % what[1:].replace("/", "-")) return " ".join(services) -SYSTEMD_SERVICE_${PN} = "${@volatile_systemd_services(d)}" +SYSTEMD_SERVICE:${PN} = "${@volatile_systemd_services(d)}" -FILES_${PN} += "${systemd_unitdir}/system/*.service" +FILES:${PN} += "${systemd_system_unitdir}/*.service ${servicedir}" + +# Set to 1 to forcibly skip OverlayFS, and default to copy+bind +AVOID_OVERLAYFS = "0" do_compile () { while read spec mountpoint; do @@ -43,37 +46,39 @@ do_compile () { continue fi - servicefile="${spec#/}" - servicefile="$(echo "$servicefile" | tr / -).service" + servicefile="$(echo "${spec#/}" | tr / -).service" + [ "$mountpoint" != ${localstatedir}/lib ] || var_lib_servicefile=$servicefile sed -e "s#@what@#$spec#g; s#@where@#$mountpoint#g" \ -e "s#@whatparent@#${spec%/*}#g; s#@whereparent@#${mountpoint%/*}#g" \ + -e "s#@avoid_overlayfs@#${@d.getVar('AVOID_OVERLAYFS')}#g" \ volatile-binds.service.in >$servicefile done <<END ${@d.getVar('VOLATILE_BINDS').replace("\\n", "\n")} END - if [ -e var-volatile-lib.service ]; then + if [ -e "$var_lib_servicefile" ]; then # As the seed is stored under /var/lib, ensure that this service runs # after the volatile /var/lib is mounted. sed -i -e "/^Before=/s/\$/ systemd-random-seed.service/" \ -e "/^WantedBy=/s/\$/ systemd-random-seed.service/" \ - var-volatile-lib.service + "$var_lib_servicefile" fi } do_compile[dirs] = "${WORKDIR}" do_install () { install -d ${D}${base_sbindir} + install -d ${D}${servicedir} install -m 0755 mount-copybind ${D}${base_sbindir}/ - install -d ${D}${systemd_unitdir}/system - for service in ${SYSTEMD_SERVICE_${PN}}; do - install -m 0644 $service ${D}${systemd_unitdir}/system/ + install -d ${D}${systemd_system_unitdir} + for service in ${SYSTEMD_SERVICE:${PN}}; do + install -m 0644 $service ${D}${systemd_system_unitdir}/ done # Suppress attempts to process some tmpfiles that are not temporary. # - install -d ${D}${sysconfdir}/tmpfiles.d ${D}/var/cache + install -d ${D}${sysconfdir}/tmpfiles.d ${D}${localstatedir}/cache ln -s /dev/null ${D}${sysconfdir}/tmpfiles.d/etc.conf ln -s /dev/null ${D}${sysconfdir}/tmpfiles.d/home.conf } |