1
0
Fork 1
mirror of https://gitlab.postmarketos.org/postmarketOS/pmbootstrap.git synced 2025-07-13 19:39:51 +03:00
Commit graph

7 commits

Author SHA1 Message Date
Casey Connolly
9f8edf539d treewide: split chroots from workdir
Introduce a new "cache" subdirectory in the pmbootstrap workdir, all the
cache and config bits go in here, anything that needs to be accessible
from inside a chroot. The whole dir is then bind-mounted into the chroot
as /cache with appropriate symlinks.

This dir is in the config as config.cache.

In addition, all the cache_* and other config dirs are renamed to
be closer to the names of the equivalent dirs in the chroot (e.g.
abuild-config) and to avoid redundant naming since they are now under a
"cache" dir.

Signed-off-by: Casey Connolly <kcxt@postmarketos.org>
2025-07-11 19:36:23 +02:00
Casey Connolly
20807bce86 pmbootstrap: unshare PID namespaec
Put ourselves in a new PID namespace so that daemons we might start in
the chroot like adbd will be killed on exit.

This simplifies "shutdown" since we no longer need to kill these
processes.

Signed-off-by: Casey Connolly <kcxt@postmarketos.org>
2025-07-11 19:35:06 +02:00
Casey Connolly
53b3415f58 init: sandbox: also map rootfs user 10000
Signed-off-by: Casey Connolly <kcxt@postmarketos.org>
2025-07-11 19:30:04 +02:00
Casey Connolly
4030cd4d61 unshare binfmt
Rework how we handle binfmt_misc so it will work inside a user
namespace.

* Use a custom mountpoint (only accessible inside the mount namespace),
  this is the crux of the change, allowing us to mount it as non-root
  and avoid messing with any host configs too!
* No longer explicitly modprobe binfmt_misc, any modern system should
  probe it automatically when we try to mount it... I think so anyways
  heh

Signed-off-by: Casey Connolly <kcxt@postmarketos.org>
2025-07-11 19:30:04 +02:00
Casey Connolly
181109bd57 pmb: sandbox: use newuidmap/newgidmap for become_user()
This really needs to be fixed up properly, basically we want to map
ourselves in as root, then support the groups <1000 (e.g. abuild uses
group id 300) and finally use our UID namespace (the biiig UIDs) for the
pmos user.

You need "USER:100000:65536" in your /etc/subuid and /etc/subgid files
where "USER" is your username.

This basically results in the chroot perms matching your user for root
and some freaky UIDs for the build user.

Signed-off-by: Casey Connolly <kcxt@postmarketos.org>
2025-07-11 19:30:04 +02:00
Casey Connolly
eb99e54aac pmb: sandbox: split out mount setup
allow it to be called directly.

Signed-off-by: Casey Connolly <casey@postmarketos.org>
2025-07-11 19:30:04 +02:00
Casey Connolly
6a1a6f648f pmb: import mkosi-sandbox
Import mkosi sandbox script which we will use as a library.

Signed-off-by: Casey Connolly <caleb@postmarketos.org>
2025-07-11 19:30:04 +02:00