Re: [OE-core] [PATCH] sanity.bbclass: raise_sanity_error if /tmp is noexec

[ChenQi <Qi.Chen@windriver.com>]

Hi Michal,

I just noticed the change. I can't find the V2 in my mailbox, so I'm 
going to reply here.
I'm a little concerned about forcing such requirement here. It does not 
seem *necessary*.
As far as I know, the whole oe-core does not need /tmp to be exec. The 
commit message says 'old meson', this means the current version of meson 
works well, right?
Also, why is there 'no simple way to workaround'? Is the recipe 
hardcoding '/tmp' instead of using API or command? Does exporting TMPDIR 
work?
e.g.,
export TMPDIR="${B}/tmp"

Regards,
Qi

On 2/9/24 23:57, Ross Burton wrote:
> On 9 Feb 2024, at 14:09, Michal Sieron via lists.openembedded.org <michalwsieron=gmail.com@lists.openembedded.org> wrote:
>> +    # Ensure /tmp is NOT mounted with noexec
>> +    with open("/proc/mounts", "r") as f:
>> +        for line in f:
>> +            # format is described in fstab(5)
>> +            _, fs_file, _, fs_mntops, *_ = line.split()
>> +
>> +            # we only want to check /tmp
>> +            if fs_file != "/tmp":
>> +                continue
>> +
>> +            # iterate through the options from the end
>> +            for opt in reversed(fs_mntops.split(",")):
>> +                if opt == "noexec":
>> +                    raise_sanity_error("/tmp shouldn't be mounted with noexec.", d)
>> +
> Alternatively, this is neater:
>
> os.statvfs("/tmp").f_flag & os.ST_NOEXEC
>
> Ross
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#195233): https://lists.openembedded.org/g/openembedded-core/message/195233
> Mute This Topic: https://lists.openembedded.org/mt/104258828/7304865
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [Qi.Chen@eng.windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>