Skip to contentSkip to conversation

base-files: change permissions on /sys and /proc

PATCH New Dan McGregor 1 participant 3 messages May 11, 2018

lore
Share & tools
lore

Dan McGregor

author
#0 lore raw

PATCH 1/3 base-files: change permissions on /sys and /proc

From: Dan McGregor <[email protected]>

Fedora uses permissions of 555 for /proc and /sys. Debian doesn't seem to explicitly set their permissions. In addition they're mounted
555. Having them be 755 causes permission issues on upgrades inside a container when the guest does not have the permission to change their modes.

So, just bite the bullet and force them to be 555.

Signed-off-by Dan McGregor <[email protected]>
---
 meta/recipes-core/base-files/base-files_3.0.14.bb | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
meta/recipes-core/base-files/base-files_3.0.14.bb +6 -2
index 1c0863b1c7b..a6963ba24d6 100644
@@ -32,15 +32,16 @@ INHIBIT_DEFAULT_DEPS = "1"
 docdir_append = "/${P}"
 dirs1777 = "/tmp ${localstatedir}/volatile/tmp"
 dirs2775 = ""
+dirs555 = "/sys /proc"
 dirs755 = "/boot /dev ${base_bindir} ${base_sbindir} ${base_libdir} \
            ${sysconfdir} ${sysconfdir}/default \
-           ${sysconfdir}/skel ${nonarch_base_libdir} /mnt /proc ${ROOT_HOME} /run \
+           ${sysconfdir}/skel ${nonarch_base_libdir} /mnt ${ROOT_HOME} /run \
            ${prefix} ${bindir} ${docdir} /usr/games ${includedir} \
            ${libdir} ${sbindir} ${datadir} \
            ${datadir}/common-licenses ${datadir}/dict ${infodir} \
            ${mandir} ${datadir}/misc ${localstatedir} \
            ${localstatedir}/backups ${localstatedir}/lib \
-           /sys ${localstatedir}/lib/misc ${localstatedir}/spool \
+           ${localstatedir}/lib/misc ${localstatedir}/spool \
            ${localstatedir}/volatile \
            ${localstatedir}/${@'volatile/' if oe.types.boolean('${VOLATILE_LOG_DIR}') else ''}log \
            /home ${prefix}/src ${localstatedir}/local \

@@ -93,6 +94,9 @@ pkg_preinst_${PN} () {
 }
 
 do_install () {
+	for d in ${dirs555}; do
+		install -m 0555 -d ${D}$d
+	done
 	for d in ${dirs755}; do
 		install -m 0755 -d ${D}$d
 	done
Signature · 1 line
2.18.0-dev
author
#1 lore raw

PATCH 2/3 base-files: use /proc/self/mounts for /etc/mtab

From: Dan McGregor <[email protected]>

It should be /proc/self/mounts instead of /proc/mounts. Also switch to using a relative link in base-files, as seems to be the convention in other distributions.

Signed-off-by Dan McGregor <[email protected]>
---
 meta/recipes-core/base-files/base-files_3.0.14.bb             | 2 +-
 .../initrdscripts/files/init-install-efi-testfs.sh            | 2 +-
 meta/recipes-core/initrdscripts/files/init-install-efi.sh     | 4 ++--
 meta/recipes-core/initrdscripts/files/init-install-testfs.sh  | 2 +-
 meta/recipes-core/initrdscripts/files/init-install.sh         | 4 ++--
 meta/recipes-core/initscripts/initscripts-1.0/checkroot.sh    | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)
meta/recipes-core/base-files/base-files_3.0.14.bb +1 -1
index a6963ba24d6..a4c22c51c77 100644
@@ -132,7 +132,7 @@ do_install () {
 	install -m 0644 ${WORKDIR}/host.conf ${D}${sysconfdir}/host.conf
 	install -m 0644 ${WORKDIR}/motd ${D}${sysconfdir}/motd
 
-	ln -sf /proc/mounts ${D}${sysconfdir}/mtab
+	ln -sf ${@oe.path.relative('${sysconfdir}', '/proc/self/mounts')} ${D}${sysconfdir}/mtab
 }
 
 DISTRO_VERSION[vardepsexclude] += "DATE"
meta/recipes-core/initrdscripts/files/init-install-efi-testfs.sh +1 -1
index 9c4b263d544..60c290e1052 100644
@@ -67,7 +67,7 @@ rm -f /etc/udev/scripts/mount*
 umount /dev/${device}* 2> /dev/null || /bin/true
 
 mkdir -p /tmp
-cat /proc/mounts > /etc/mtab
+cat /proc/self/mounts > /etc/mtab
 
 disk_size=$(parted /dev/${device} unit mb print | grep '^Disk .*: .*MB' | cut -d" " -f 3 | sed -e "s/MB//")
meta/recipes-core/initrdscripts/files/init-install-efi.sh +2 -2
index 82b0aa819e3..838bc83fdb8 100644
@@ -141,8 +141,8 @@ umount ${device}* 2> /dev/null || /bin/true
 mkdir -p /tmp
 
 # Create /etc/mtab if not present
-if [ ! -e /etc/mtab ] && [ -e /proc/mounts ]; then
-    ln -sf /proc/mounts /etc/mtab
+if [ ! -e /etc/mtab ] && [ -e /proc/self/mounts ]; then
+    ln -sf /proc/self/mounts /etc/mtab
 fi
 
 disk_size=$(parted ${device} unit mb print | grep '^Disk .*: .*MB' | cut -d" " -f 3 | sed -e "s/MB//")
meta/recipes-core/initrdscripts/files/init-install-testfs.sh +1 -1
index ac621605287..c5b435286e7 100644
@@ -91,7 +91,7 @@ fi
 
 mkdir -p /tmp
 if [ ! -L /etc/mtab ]; then
-	cat /proc/mounts > /etc/mtab
+	cat /proc/self/mounts > /etc/mtab
 fi
 
 disk_size=$(parted /dev/${device} unit mb print | grep Disk | cut -d" " -f 3 | sed -e "s/MB//")
meta/recipes-core/initrdscripts/files/init-install.sh +2 -2
index 28e8f09d19d..e203caa32f1 100644
@@ -137,8 +137,8 @@ if [ ! -b /dev/loop0 ] ; then
 fi
 
 mkdir -p /tmp
-if [ ! -L /etc/mtab ] && [ -e /proc/mounts ]; then
-    ln -sf /proc/mounts /etc/mtab
+if [ ! -L /etc/mtab ] && [ -e /proc/self/mounts ]; then
+    ln -sf /proc/self/mounts /etc/mtab
 fi
 
 disk_size=$(parted ${device} unit mb print | grep '^Disk .*: .*MB' | cut -d" " -f 3 | sed -e "s/MB//")
meta/recipes-core/initscripts/initscripts-1.0/checkroot.sh +1 -1
index 02f0351fcb3..db472ac2676 100755
@@ -142,7 +142,7 @@ fi
 mount -n -o remount,$rootmode /
 if test "$rootmode" = rw
 then
-	ln -sf /proc/mounts /dev/mtab
+	ln -sf /proc/self/mounts /dev/mtab
 fi
 
 : exit 0
Signature · 1 line
2.18.0-dev
author
#2 lore raw

PATCH 3/3 base-files: make root home mode customisable

In reply to Dan McGregor

From: Dan McGregor <[email protected]>

Signed-off-by Dan McGregor <[email protected]>
---
 meta/conf/bitbake.conf                            | 1 +
 meta/files/fs-perms-persistent-log.txt            | 4 ++--
 meta/files/fs-perms.txt                           | 4 ++--
 meta/recipes-core/base-files/base-files_3.0.14.bb | 4 +++-
 4 files changed, 8 insertions(+), 5 deletions(-)
meta/conf/bitbake.conf +1 -0
index a21b7282fbd..cd07b86a99c 100644
@@ -84,6 +84,7 @@ USRBINPATH_class-nativesdk = "/usr/bin"
 
 # Root home directory
 ROOT_HOME ??= "/home/root"
+ROOT_HOME_MODE ??= "0700"
 
 # If set to boolean true ('yes', 'y', 'true', 't', '1'), /var/log links to /var/volatile/log.
 # If set to boolean false ('no', 'n', 'false', 'f', '0'), /var/log is on persistent storage.
meta/files/fs-perms-persistent-log.txt +2 -2
index 3a7cf3ab945..e16c4464843 100644
@@ -59,8 +59,8 @@ ${localstatedir}/local		0755	root	root	false - - -
 /tmp				01777	root	root	false - - -
 ${localstatedir}/volatile/tmp	01777	root	root	false - - -
 
-# Set 0700
-${ROOT_HOME}			0700	root	root	false - - -
+# Set ${ROOT_HOME_MODE}, by default 0700.
+${ROOT_HOME}			${ROOT_HOME_MODE}	root	root	false - - -
 
 # Set 2775-lsb
 ${localstatedir}/mail		02775	root	mail	false - - -
meta/files/fs-perms.txt +2 -2
index c8c3ac5dbed..ad180399105 100644
@@ -60,8 +60,8 @@ ${localstatedir}/local		0755	root	root	false - - -
 /tmp				01777	root	root	false - - -
 ${localstatedir}/volatile/tmp	01777	root	root	false - - -
 
-# Set 0700
-${ROOT_HOME}			0700	root	root	false - - -
+# Set ${ROOT_HOME_MODE}, by default 0700.
+${ROOT_HOME}			${ROOT_HOME_MODE}	root	root	false - - -
 
 # Set 2775-lsb
 ${localstatedir}/mail		02775	root	mail	false - - -
meta/recipes-core/base-files/base-files_3.0.14.bb +3 -1
index a4c22c51c77..6267b649465 100644
@@ -35,7 +35,7 @@ dirs2775 = ""
 dirs555 = "/sys /proc"
 dirs755 = "/boot /dev ${base_bindir} ${base_sbindir} ${base_libdir} \
            ${sysconfdir} ${sysconfdir}/default \
-           ${sysconfdir}/skel ${nonarch_base_libdir} /mnt ${ROOT_HOME} /run \
+           ${sysconfdir}/skel ${nonarch_base_libdir} /mnt /run \
            ${prefix} ${bindir} ${docdir} /usr/games ${includedir} \
            ${libdir} ${sbindir} ${datadir} \
            ${datadir}/common-licenses ${datadir}/dict ${infodir} \

@@ -110,6 +110,8 @@ do_install () {
 		ln -sf volatile/$d ${D}${localstatedir}/$d
 	done
 
+	install -m ${ROOT_HOME_MODE} -d ${D}${ROOT_HOME}
+
 	ln -snf ../run ${D}${localstatedir}/run
 	ln -snf ../run/lock ${D}${localstatedir}/lock
Signature · 1 line
2.18.0-dev