particle-os/debian-forge-composer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

image-info: ensure that directory is analysed as read-only

Browse source 
In some cases, e.g. when analysing an extracted `tar` image, it could
happen that the tools used by `image-info` to analyse the image could
modify its content (e.g. create new files which were originally not on
the image). This is especially an issue with `rpm`, which DB backend
seemed to create files in `/var/lib/rpm/` when run.

Ensure that the analysed directory can not be modified by bind-mounting
it as a read only, before the analysis.

Signed-off-by: Tomas Hozza <thozza@redhat.com>
This commit is contained in:
Tomas Hozza 2021-10-05 14:44:46 +02:00 • committed by Tomáš Hozza
parent 1a7858c196
commit 71cfc35b67
1 changed files with 13 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

19
tools/image-info
View file

@ -2202,12 +2202,19 @@ def analyse_image(image):
def append_directory(report, tree):
if os.path.lexists(f"{tree}/ostree"):
os.makedirs(f"{tree}/etc", exist_ok=True)
with mount_at(f"{tree}/usr/etc", f"{tree}/etc", extra=["--bind"]):
append_filesystem(report, tree, is_ostree=True)
else:
append_filesystem(report, tree)
with tempfile.TemporaryDirectory(dir="/var/tmp") as tmpdir:
tree_ro = os.path.join(tmpdir, "root_ro")
os.makedirs(tree_ro)
# Make sure that the tools which analyse the directory in-place
# can not modify its content (e.g. create additional files).
# mount_at() always mounts the source as read-only!
with mount_at(tree, tree_ro, ["bind"]) as mountpoint:
if os.path.lexists(f"{tree}/ostree"):
os.makedirs(f"{tree}/etc", exist_ok=True)
with mount_at(f"{tree}/usr/etc", f"{tree}/etc", extra=["--bind"]):
append_filesystem(report, tree_ro, is_ostree=True)
else:
append_filesystem(report, tree_ro)
def append_ostree_repo(report, repo):