[2/2] mount-copybind: add MOUNT_COPYBIND_AVOID_OVERLAYFS env var to skip OverlayFS

Message ID 20220325184032.1880706-2-luca.boccassi@gmail.com
State Accepted, archived
Commit a8e7dca69054798b1c9843a0de889cef3e261c4f
Headers show
Series [1/2] mount-copybind: fix shellcheck warning | expand

Commit Message

Luca Boccassi March 25, 2022, 6:40 p.m. UTC
From: Luca Boccassi <luca.boccassi@microsoft.com>

In some cases we don't want to even attempt to set up OverlayFS, for
example because SELinux in enforcing mode would kill the process
attempting to use the mount. See:

https://lore.kernel.org/all/CA+FmFJBDwt52Z-dVGfuUcnRMiMtGPhK4cCQJ=J_fg0r3x-b6ng@mail.gmail.com/T/#mef98aa406324096d1889d3d467251f30456f403c

If MOUNT_COPYBIND_AVOID_OVERLAYFS=1 is set, skip directly to copy and
bind mount.

Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
---
 meta/recipes-core/volatile-binds/files/mount-copybind | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Michael Opdenacker March 28, 2022, 3:30 p.m. UTC | #1
Hi Luca,

On 3/25/22 19:40, Luca Bocassi wrote:
> From: Luca Boccassi <luca.boccassi@microsoft.com>
>
> In some cases we don't want to even attempt to set up OverlayFS, for
> example because SELinux in enforcing mode would kill the process
> attempting to use the mount. See:
>
> https://lore.kernel.org/all/CA+FmFJBDwt52Z-dVGfuUcnRMiMtGPhK4cCQJ=J_fg0r3x-b6ng@mail.gmail.com/T/#mef98aa406324096d1889d3d467251f30456f403c
>
> If MOUNT_COPYBIND_AVOID_OVERLAYFS=1 is set, skip directly to copy and
> bind mount.
>
> Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>


Thanks for the patch!
Now that the patch is merged, would you mind proposing a patch to add a
description of it to the documentation? You'll probably do it better
than I would.

Thanks in advance
Michael.
Luca Boccassi March 28, 2022, 3:32 p.m. UTC | #2
On Mon, 2022-03-28 at 17:30 +0200, Michael Opdenacker wrote:
> Hi Luca,
> 
> On 3/25/22 19:40, Luca Bocassi wrote:
> > From: Luca Boccassi <luca.boccassi@microsoft.com>
> > 
> > In some cases we don't want to even attempt to set up OverlayFS, for
> > example because SELinux in enforcing mode would kill the process
> > attempting to use the mount. See:
> > 
> > https://lore.kernel.org/all/CA+FmFJBDwt52Z-dVGfuUcnRMiMtGPhK4cCQJ=J_fg0r3x-b6ng@mail.gmail.com/T/#mef98aa406324096d1889d3d467251f30456f403c
> > 
> > If MOUNT_COPYBIND_AVOID_OVERLAYFS=1 is set, skip directly to copy and
> > bind mount.
> > 
> > Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
> 
> 
> Thanks for the patch!
> Now that the patch is merged, would you mind proposing a patch to add a
> description of it to the documentation? You'll probably do it better
> than I would.
> 
> Thanks in advance
> Michael.

Sure I can do that, where should it be listed exactly?
Michael Opdenacker March 28, 2022, 4:08 p.m. UTC | #3
Hi Luca,

On 3/28/22 17:32, Luca Bocassi wrote:
>
>> Thanks for the patch!
>> Now that the patch is merged, would you mind proposing a patch to add a
>> description of it to the documentation? You'll probably do it better
>> than I would.
>>
>> Thanks in advance
>> Michael.
> Sure I can do that, where should it be listed exactly?


Great!
Well, I was thinking about adding an entry to
https://git.yoctoproject.org/yocto-docs/tree/documentation/ref-manual/variables.rst
corresponding to https://docs.yoctoproject.org/ref-manual/variables.html

However, I'm starting to have doubts as "volatile-binds" are not even
documented. Is this new variable meant to be used in the configuration
file? If so, it probably needs documenting, but it's nice when a
variable is either attached to a bbclass or is introduced in one of the
manuals too.

Ideas anyone?
Thanks again
Michael.

Patch

diff --git a/meta/recipes-core/volatile-binds/files/mount-copybind b/meta/recipes-core/volatile-binds/files/mount-copybind
index 8bbb406b3a..ddc4357615 100755
--- a/meta/recipes-core/volatile-binds/files/mount-copybind
+++ b/meta/recipes-core/volatile-binds/files/mount-copybind
@@ -2,6 +2,9 @@ 
 #
 # Perform a bind mount, copying existing files as we do so to ensure the
 # overlaid path has the necessary content.
+# If the target is a directory and overlayfs is available (and the environment
+# variable MOUNT_COPYBIND_AVOID_OVERLAYFS=1 is not set), then an overlay mount
+# will be attempted first.
 
 if [ $# -lt 2 ]; then
     echo >&2 "Usage: $0 spec mountpoint [OPTIONS]"
@@ -51,7 +54,7 @@  if [ -d "$mountpoint" ]; then
             mountcontext=",rootcontext=$(matchpathcon -n "$mountpoint")"
         fi
     fi
-    if ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir""$mountcontext" "$mountpoint" > /dev/null 2>&1; then
+    if [ "$MOUNT_COPYBIND_AVOID_OVERLAYFS" = 1 ] || ! mount -t overlay overlay -olowerdir="$mountpoint",upperdir="$spec",workdir="$overlay_workdir""$mountcontext" "$mountpoint" > /dev/null 2>&1; then
 
         if [ "$specdir_existed" != "yes" ]; then
             cp -aPR "$mountpoint"/. "$spec/"