[RFC PATCH] bind: add support for read-only rootfs

[Mark Hatle <mark.hatle@windriver.com>]

From: Chen Qi <Qi.Chen@windriver.com>

This patch adds support for read-only rootfs to the bind service.

Now the init script will check a variable, ALLOW_ROOTFS_READ_ONLY,
to see whether it should start the bind service in a read-only rootfs
or not. The value is by default unset, thus disabling starting bind
service in a read-only rootfs. If the variable is set to "yes", as
stated in the configuration file, the init script would try to make
necessary bind mounts so that the bind service could be started correctly.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
---
 meta/recipes-connectivity/bind/bind-9.8.1/bind9    |  3 +
 .../init.d-add-support-for-read-only-rootfs.patch  | 70 +++++++++++++++++
 .../bind/bind-9.8.1/init.d-fix-indentation.patch   | 90 ++++++++++++++++++++++
 meta/recipes-connectivity/bind/bind_9.8.1.bb       |  3 +
 4 files changed, 166 insertions(+)
 create mode 100644 meta/recipes-connectivity/bind/bind-9.8.1/init.d-add-support-for-read-only-rootfs.patch
 create mode 100644 meta/recipes-connectivity/bind/bind-9.8.1/init.d-fix-indentation.patch

diff --git a/meta/recipes-connectivity/bind/bind-9.8.1/bind9 b/meta/recipes-connectivity/bind/bind-9.8.1/bind9
index 3d5b69b..2774334 100644
--- a/meta/recipes-connectivity/bind/bind-9.8.1/bind9
+++ b/meta/recipes-connectivity/bind/bind-9.8.1/bind9
@@ -28,3 +28,6 @@
 ROOTDIR="/var/named/chroot"
 OPTIONS="-u bind"
 
+# When using a read-only rootfs additional setup may be required
+# uncomment the following line to make bind start in read-only rootfs
+#ALLOW_ROOTFS_READ_ONLY="yes"
diff --git a/meta/recipes-connectivity/bind/bind-9.8.1/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind-9.8.1/init.d-add-support-for-read-only-rootfs.patch
new file mode 100644
index 0000000..13166da
--- /dev/null
+++ b/meta/recipes-connectivity/bind/bind-9.8.1/init.d-add-support-for-read-only-rootfs.patch
@@ -0,0 +1,70 @@
+Subject: init.d: add support for read-only rootfs
+
+Upstream-Status: Inappropriate [oe-core specific]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ init.d | 45 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+diff --git a/init.d b/init.d
+index 4a1faaa..70e0219 100644
+--- a/init.d
++++ b/init.d
+@@ -6,8 +6,53 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin
+ # Don't modify this line, change or create /etc/default/bind9.
+ OPTIONS=""
+ 
++test -f /etc/default/rcS && . /etc/default/rcS
+ test -f /etc/default/bind9 && . /etc/default/bind9
+ 
++# This function is here because it's possible that /var and / are on different partitions.
++is_on_read_only_partition () {
++    DIRECTORY=$1
++    dir=`readlink -f $DIRECTORY`
++    while true; do
++	if [ ! -d "$dir" ]; then
++	    echo "ERROR: $dir is not a directory"
++	    exit 1
++	else
++	    for flag in `awk -v dir=$dir '{ if ($2 == dir) { print "FOUND"; split($4,FLAGS,",") } }; \
++		END { for (f in FLAGS) print FLAGS[f] }' < /proc/mounts`; do
++		[ "$flag" = "FOUND" ] && partition="read-write"
++		[ "$flag" = "ro" ] && { partition="read-only"; break; }
++	    done
++	    if [ "$dir" = "/" -o -n "$partition" ]; then
++		break
++	    else
++		dir=`dirname $dir`
++	    fi
++	fi
++    done
++    [ "$partition" = "read-only" ] && echo "yes" || echo "no"
++}
++
++bind_mount () {
++    olddir=$1
++    newdir=$2
++    mkdir -p $olddir
++    cp -a $newdir/* $olddir
++    mount --bind $olddir $newdir
++}
++
++# Deal with read-only rootfs
++if [ "$ROOTFS_READ_ONLY" = "yes" ]; then
++    if [ "$ALLOW_ROOTFS_READ_ONLY" = "yes" ]; then
++	[ "$VERBOSE" != "no" ] && echo "WARN: start bind service in read-only rootfs"
++	[ `is_on_read_only_partition /etc/bind` = "yes" ] && bind_mount /var/volatile/bind/etc /etc/bind
++	[ `is_on_read_only_partition /var/named` = "yes" ] && bind_mount /var/volatile/bind/named /var/named
++    else
++	[ "$VERBOSE" != "no" ] && echo "WARN: read-only rootfs, bind service disabled"
++	exit 0
++    fi
++fi
++
+ test -x /usr/sbin/rndc || exit 0
+ 
+ if [ -n "$ROOTDIR" ]; then
+-- 
+1.8.3.1
+
diff --git a/meta/recipes-connectivity/bind/bind-9.8.1/init.d-fix-indentation.patch b/meta/recipes-connectivity/bind/bind-9.8.1/init.d-fix-indentation.patch
new file mode 100644
index 0000000..0833685
--- /dev/null
+++ b/meta/recipes-connectivity/bind/bind-9.8.1/init.d-fix-indentation.patch
@@ -0,0 +1,90 @@
+Subject: init.d: fix indentation
+
+Upstream-Status: Inappropriate [oe-core specific]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ init.d | 64 ++++++++++++++++++++++++++++++++--------------------------------
+ 1 file changed, 32 insertions(+), 32 deletions(-)
+
+diff --git a/init.d b/init.d
+index ff641ea..4a1faaa 100644
+--- a/init.d
++++ b/init.d
+@@ -22,41 +22,41 @@ ROOTDIR_MOUNT='/etc/bind /var/run/named /var/run/bind /var/cache/bind
+ /etc/localtime /dev/random /dev/zero /dev/null'
+ 
+ mount_chroot_conf() {
+-  if [ -n "$ROOTDIR" ]; then
+-    for all in $ROOTDIR_MOUNT; do
+-      # Skip nonexistant files
+-      [ -e "$all" ] || continue
+-
+-      # If mount source is a file
+-      if ! [ -d "$all" ]; then
+-        # mount it only if it is not present in chroot or it is empty
+-        if ! [ -e "$ROOTDIR$all" ] || [ `stat -c'%s' "$ROOTDIR$all"` -eq 0 ]; then
+-          touch "$ROOTDIR$all"
+-          mount --bind "$all" "$ROOTDIR$all"
+-        fi
+-      else
+-        # Mount source is a directory. Mount it only if directory in chroot is
+-        # empty.
+-	if [ -e "$all" ] && [ `ls -1A $ROOTDIR$all | wc -l` -eq 0 ]; then
+-          mount --bind "$all" "$ROOTDIR$all"
+-	fi
+-      fi
+-    done
+-  fi
++    if [ -n "$ROOTDIR" ]; then
++	for all in $ROOTDIR_MOUNT; do
++            # Skip nonexistant files
++	    [ -e "$all" ] || continue
++
++            # If mount source is a file
++	    if ! [ -d "$all" ]; then
++                # mount it only if it is not present in chroot or it is empty
++		if ! [ -e "$ROOTDIR$all" ] || [ `stat -c'%s' "$ROOTDIR$all"` -eq 0 ]; then
++		    touch "$ROOTDIR$all"
++		    mount --bind "$all" "$ROOTDIR$all"
++		fi
++	    else
++                # Mount source is a directory. Mount it only if directory in chroot is
++                # empty.
++		if [ -e "$all" ] && [ `ls -1A $ROOTDIR$all | wc -l` -eq 0 ]; then
++		    mount --bind "$all" "$ROOTDIR$all"
++		fi
++	    fi
++	done
++    fi
+ }
+ 
+ umount_chroot_conf() {
+-  if [ -n "$ROOTDIR" ]; then
+-    for all in $ROOTDIR_MOUNT; do
+-      # Check if file is mount target. Do not use /proc/mounts because detecting
+-      # of modified mounted files can fail.
+-      if mount | grep -q '.* on '"$ROOTDIR$all"' .*'; then
+-        umount "$ROOTDIR$all"
+-        # Remove temporary created files
+-        [ -f "$all" ] && rm -f "$ROOTDIR$all"
+-      fi
+-    done
+-  fi
++    if [ -n "$ROOTDIR" ]; then
++	for all in $ROOTDIR_MOUNT; do
++            # Check if file is mount target. Do not use /proc/mounts because detecting
++            # of modified mounted files can fail.
++	    if mount | grep -q '.* on '"$ROOTDIR$all"' .*'; then
++		umount "$ROOTDIR$all"
++                # Remove temporary created files
++		[ -f "$all" ] && rm -f "$ROOTDIR$all"
++	    fi
++	done
++    fi
+ }
+ 
+ case "$1" in
+-- 
+1.8.3.1
+
diff --git a/meta/recipes-connectivity/bind/bind_9.8.1.bb b/meta/recipes-connectivity/bind/bind_9.8.1.bb
index b28829b..66a092c 100644
--- a/meta/recipes-connectivity/bind/bind_9.8.1.bb
+++ b/meta/recipes-connectivity/bind/bind_9.8.1.bb
@@ -21,6 +21,8 @@ SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
            file://mips1-not-support-opcode.diff \
            file://bind9 \
            file://setup-chroot-hooks.patch \
+           file://init.d-fix-indentation.patch \
+           file://init.d-add-support-for-read-only-rootfs.patch \
 	   "
 
 SRC_URI[md5sum] = "cf31117c5d35af34d4c0702970ad9fb7"
@@ -58,6 +60,7 @@ do_install_append() {
 	rm "${D}${mandir}/man1/nslookup.1"
 	rmdir "${D}${localstatedir}/run"
 	rmdir --ignore-fail-on-non-empty "${D}${localstatedir}"
+	install -d "${D}${localstatedir}/cache/bind"
 	install -d "${D}${sysconfdir}/bind"
 	install -d "${D}${sysconfdir}/init.d"
 	install -m 644 ${S}/conf/* "${D}${sysconfdir}/bind/"
-- 
1.8.1.2.545.g2f19ada