Re: [OE-core] [PATCH] sanity.bbclass: raise_sanity_error if /tmp is noexec

ChenQi
2024-02-21T07:18:55Z

Hi Michal,

I just noticed the change. I can't find the V2 in my mailbox, so I'm
going to reply here.
I'm a little concerned about forcing such requirement here. It does not
seem *necessary*.
As far as I know, the whole oe-core does not need /tmp to be exec. The
commit message says 'old meson', this means the current version of meson
works well, right?
Also, why is there 'no simple way to workaround'? Is the recipe
hardcoding '/tmp' instead of using API or command? Does exporting TMPDIR
work?
e.g.,
export TMPDIR="${B}/tmp"

Regards,
Qi

On 2/9/24 23:57, Ross Burton wrote:
> On 9 Feb 2024, at 14:09, Michal Sieron via lists.openembedded.org <michalwsieron=gmail.com@lists.openembedded.org> wrote:
>> + # Ensure /tmp is NOT mounted with noexec
>> + with open("/proc/mounts", "r") as f:
>> + for line in f:
>> + # format is described in fstab(5)
>> + _, fs_file, _, fs_mntops, *_ = line.split()
>> +
>> + # we only want to check /tmp
>> + if fs_file != "/tmp":
>> + continue
>> +
>> + # iterate through the options from the end
>> + for opt in reversed(fs_mntops.split(",")):
>> + if opt == "noexec":
>> + raise_sanity_error("/tmp shouldn't be mounted with noexec.", d)
>> +
> Alternatively, this is neater:
>
> os.statvfs("/tmp").f_flag & os.ST_NOEXEC
>
> Ross
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#195233): https://lists.openembedded.org/g/openembedded-core/message/195233
> Mute This Topic: https://lists.openembedded.org/mt/104258828/7304865
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [Qi.Chen@eng.windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>