[PATCH] sanity.bbclass: raise_sanity_error if /tmp is noexec

Michal Sieron
2024-02-09T14:10:06Z

meson saves its temporary scripts in /tmp.
Similarly some recipies also do that (e.g. ccan in sbsigntool).

As this can lead to unexpected build failures with no simple way
to workaround, make such setup a fatal error.

Signed-off-by: Michal Sieron <michalwsieron@gmail.com>
---
meta/classes-global/sanity.bbclass | 15 +++++++++++++++
1 file changed, 15 insertions(+)

diff --git a/meta/classes-global/sanity.bbclass b/meta/classes-global/sanity.bbclass
index 1bd74e1935..205516bf6a 100644
--- a/meta/classes-global/sanity.bbclass
+++ b/meta/classes-global/sanity.bbclass
@@ -840,6 +840,21 @@ def check_sanity_everybuild(status, d):
status.addresult("Please use a umask which allows a+rx and u+rwx\n")
os.umask(omask)

+ # Ensure /tmp is NOT mounted with noexec
+ with open("/proc/mounts", "r") as f:
+ for line in f:
+ # format is described in fstab(5)
+ _, fs_file, _, fs_mntops, *_ = line.split()
+
+ # we only want to check /tmp
+ if fs_file != "/tmp":
+ continue
+
+ # iterate through the options from the end
+ for opt in reversed(fs_mntops.split(",")):
+ if opt == "noexec":
+ raise_sanity_error("/tmp shouldn't be mounted with noexec.", d)
+
if d.getVar('TARGET_ARCH') == "arm":
# This path is no longer user-readable in modern (very recent) Linux
try:
--
2.43.0