diff mbox series

[1/1] isar-mounts: mount /run as tmpfs for systemd execution in chroot

Message ID 20260923143350.2086040-1-felix.moessbauer@siemens.com
State Under Review
Headers show
Series [1/1] isar-mounts: mount /run as tmpfs for systemd execution in chroot | expand

Commit Message

MOESSBAUER, Felix Sept. 23, 2026, 2:33 p.m. UTC 
When running systemd inside the chroot, it might access /run and place
files there. These can have ownerships (like 0000) which require DAC
capabilities for traversing and removing. As this is tricky to achieve
across all cleanup code, we stick to the systemd file system hierarchy
and mount /run as a tmpfs. By that, all files below it will
automatically be dropped when leaving the namespace.

This solves cleanup issues on rootless like:
  find: '<...>/rootfs/run/systemd/dissect-root': Permission denied

As we anyways cleanup the /run in do_rootfs_finalize (image only), this
does not change the content of the image. However, it improves the
reproduciblity of our internal rootfs' which can improve caching.

Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-global/base.bbclass | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass
index 8f81ab70..3d5d1c12 100644
--- a/meta/classes-global/base.bbclass
+++ b/meta/classes-global/base.bbclass
@@ -399,6 +399,10 @@  def insert_isar_mounts(d, rootfs, mounts):
         lines.append('mount -t devpts -o noexec,nosuid,uid=5,mode=620,ptmxmode=666 none {}/dev/pts'.format(rootfs))
         lines.append('( cd {}/dev; ln -sf pts/ptmx . )'.format(rootfs))
         lines.append('mount -t tmpfs none {}/dev/shm'.format(rootfs))
+        # required by systemd file-system hierarchy
+        lines.append('mount -t tmpfs -o mode=0755 tmpfs {}/run'.format(rootfs))
+        # required by Debian policy 9.1.4
+        lines.append('mkdir {}/run/lock'.format(rootfs))
         lines.append('mount -o bind /dev/random {}/dev/random'.format(rootfs))
         lines.append('mount -o bind /dev/urandom {}/dev/urandom'.format(rootfs))
         lines.append('mount -t proc none {}/proc'.format(rootfs))