[PATCH] volatile-binds: add recipe variable to allow disabling OverlayFS

[PATCH] volatile-binds: add recipe variable to allow disabling OverlayFS

[luca.boccassi]

From: Luca Boccassi <luca.boccassi@microsoft.com>

Use the new MOUNT_COPYBIND_AVOID_OVERLAYFS flag provided by mount-copybind.
When SELinux is enabled, processes accessing OverlayFS mounts will get a denial
if the process setting up the mount doesn't have all the permissions that
the accessor has.

Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
---
 .../volatile-binds/files/volatile-binds.service.in            | 1 +
 meta/recipes-core/volatile-binds/volatile-binds.bb            | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
index e2ad39f258..6612d2aae0 100644
--- a/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
+++ b/meta/recipes-core/volatile-binds/files/volatile-binds.service.in
@@ -11,6 +11,7 @@ ConditionPathIsReadWrite=!@where@
 Type=oneshot
 RemainAfterExit=Yes
 TimeoutSec=0
+Environment=MOUNT_COPYBIND_AVOID_OVERLAYFS=@avoid_overlayfs@
 ExecStart=/sbin/mount-copybind @what@ @where@
 ExecStop=/bin/umount @where@
 
diff --git a/meta/recipes-core/volatile-binds/volatile-binds.bb b/meta/recipes-core/volatile-binds/volatile-binds.bb
index d5c5538cd7..3fefa9abde 100644
--- a/meta/recipes-core/volatile-binds/volatile-binds.bb
+++ b/meta/recipes-core/volatile-binds/volatile-binds.bb
@@ -37,6 +37,9 @@ SYSTEMD_SERVICE:${PN} = "${@volatile_systemd_services(d)}"
 
 FILES:${PN} += "${systemd_system_unitdir}/*.service ${servicedir}"
 
+# Set to 1 to forcibly skip OverlayFS, and default to copy+bind
+AVOID_OVERLAYFS = "0"
+
 do_compile () {
     while read spec mountpoint; do
         if [ -z "$spec" ]; then
@@ -47,6 +50,7 @@ do_compile () {
         servicefile="$(echo "$servicefile" | tr / -).service"
         sed -e "s#@what@#$spec#g; s#@where@#$mountpoint#g" \
             -e "s#@whatparent@#${spec%/*}#g; s#@whereparent@#${mountpoint%/*}#g" \
+            -e "s#@avoid_overlayfs@#${@d.getVar('AVOID_OVERLAYFS')}#g" \
             volatile-binds.service.in >$servicefile
     done <<END
 ${@d.getVar('VOLATILE_BINDS').replace("\\n", "\n")}
-- 
2.34.1