diff mbox series

[2/2] image: clear /run to not leak build system data

Message ID 20260706101217.1385245-2-felix.moessbauer@siemens.com
State New
Headers show
Series [1/2] image: delete entries below /dev | expand

Commit Message

Felix Moessbauer July 6, 2026, 10:12 a.m. UTC 
According to Filesystem Hierarchy Standard (FHS), /run is always a
tmpfs. On Debian buster this is already the case. We however need to
keep /run/lock due to debian policy 9.1.4. Clear the rest, to not
leak build system data into the image.

We have to do this in the finalize step, as nothing must be mounted.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-recipe/image.bbclass | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index 6b02ff8e..a44c6de4 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -470,8 +470,10 @@  do_rootfs_finalize() {
         # Clear /dev on schroot as mmdebstrap --skip=output/dev (unshare) does not deploy it
         find ${ROOTFSDIR}/dev -mindepth 1 -maxdepth 1 -exec rm -rf {} \;
 
-        rm -f "${ROOTFSDIR}/run/blkid/blkid.tab"
-        rm -f "${ROOTFSDIR}/run/blkid/blkid.tab.old"
+        # according to FHS, /run is a tmpfs. Clear it to not leak build system data
+        # skip deleting /run/lock as /var/lock is a symlink to it according to Debian policy 9.1.4
+        find ${ROOTFSDIR}/run/lock -mindepth 1 -maxdepth 1 -exec rm -rf {} \;
+        find ${ROOTFSDIR}/run -mindepth 1 -maxdepth 1 ! -name lock -exec rm -rf {} \;
 EOSUDO
 
     # Sometimes qemu-user-static generates coredumps in chroot, move them