|
 |
a3e2b5 |
From f58c5ced373c2532b5cc44ba2e0c3a28b41472f2 Mon Sep 17 00:00:00 2001
|
|
|
a3e2b5 |
From: Jan Synacek <jsynacek@redhat.com>
|
|
|
a3e2b5 |
Date: Tue, 15 May 2018 09:24:20 +0200
|
|
|
a3e2b5 |
Subject: [PATCH] Avoid /tmp being mounted as tmpfs without the user's will
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
Ensure PrivateTmp doesn't require tmpfs through tmp.mount, but rather
|
|
|
a3e2b5 |
adds an After relationship.
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
rhel-only
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
Resolves: #1578772
|
|
|
a3e2b5 |
---
|
|
|
a3e2b5 |
src/core/unit.c | 12 ++++++------
|
|
|
a3e2b5 |
units/basic.target | 3 ++-
|
|
|
a3e2b5 |
2 files changed, 8 insertions(+), 7 deletions(-)
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
diff --git a/src/core/unit.c b/src/core/unit.c
|
|
|
a3e2b5 |
index 113205bf25..c9f756c9c7 100644
|
|
|
a3e2b5 |
--- a/src/core/unit.c
|
|
|
a3e2b5 |
+++ b/src/core/unit.c
|
|
|
a3e2b5 |
@@ -982,13 +982,13 @@ int unit_add_exec_dependencies(Unit *u, ExecContext *c) {
|
|
|
a3e2b5 |
return 0;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
if (c->private_tmp) {
|
|
|
a3e2b5 |
- const char *p;
|
|
|
a3e2b5 |
+ r = unit_add_dependency_by_name(u, UNIT_AFTER, "tmp.mount", NULL, true, UNIT_DEPENDENCY_FILE);
|
|
|
a3e2b5 |
+ if (r < 0)
|
|
|
a3e2b5 |
+ return r;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
- FOREACH_STRING(p, "/tmp", "/var/tmp") {
|
|
|
a3e2b5 |
- r = unit_require_mounts_for(u, p, UNIT_DEPENDENCY_FILE);
|
|
|
a3e2b5 |
- if (r < 0)
|
|
|
a3e2b5 |
- return r;
|
|
|
a3e2b5 |
- }
|
|
|
a3e2b5 |
+ r = unit_require_mounts_for(u, "/var/tmp", UNIT_DEPENDENCY_FILE);
|
|
|
a3e2b5 |
+ if (r < 0)
|
|
|
a3e2b5 |
+ return r;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
r = unit_add_dependency_by_name(u, UNIT_AFTER, SPECIAL_TMPFILES_SETUP_SERVICE, NULL, true, UNIT_DEPENDENCY_FILE);
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
diff --git a/units/basic.target b/units/basic.target
|
|
|
a3e2b5 |
index 4f44292249..8fc7c73ef2 100644
|
|
|
a3e2b5 |
--- a/units/basic.target
|
|
|
a3e2b5 |
+++ b/units/basic.target
|
|
|
a3e2b5 |
@@ -19,4 +19,5 @@ After=sysinit.target sockets.target paths.target slices.target tmp.mount
|
|
|
a3e2b5 |
# require /var and /var/tmp, but only add a Wants= type dependency on /tmp, as
|
|
|
a3e2b5 |
# we support that unit being masked, and this should not be considered an error.
|
|
|
a3e2b5 |
RequiresMountsFor=/var /var/tmp
|
|
|
a3e2b5 |
-Wants=tmp.mount
|
|
|
a3e2b5 |
+# RHEL-only: Disable /tmp on tmpfs.
|
|
|
a3e2b5 |
+#Wants=tmp.mount
|