mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
synced 2026-04-04 20:57:45 -04:00
576ee5dfd4
Currently pivot_root() doesn't work on the real rootfs because it
cannot be unmounted. Userspace has to do a recursive removal of the
initramfs contents manually before continuing the boot.
Really all we want from the real rootfs is to serve as the parent mount
for anything that is actually useful such as the tmpfs or ramfs for
initramfs unpacking or the rootfs itself. There's no need for the real
rootfs to actually be anything meaningful or useful. Add a immutable
rootfs called "nullfs" that can be selected via the "nullfs_rootfs"
kernel command line option.
The kernel will mount a tmpfs/ramfs on top of it, unpack the initramfs
and fire up userspace which mounts the rootfs and can then just do:
chdir(rootfs);
pivot_root(".", ".");
umount2(".", MNT_DETACH);
and be done with it. (Ofc, userspace can also choose to retain the
initramfs contents by using something like pivot_root(".", "/initramfs")
without unmounting it.)
Technically this also means that the rootfs mount in unprivileged
namespaces doesn't need to become MNT_LOCKED anymore as it's guaranteed
that the immutable rootfs remains permanently empty so there cannot be
anything revealed by unmounting the covering mount.
In the future this will also allow us to create completely empty mount
namespaces without risking to leak anything.
systemd already handles this all correctly as it tries to pivot_root()
first and falls back to MS_MOVE only when that fails.
This goes back to various discussion in previous years and a LPC 2024
presentation about this very topic.
Link: https://patch.msgid.link/20260112-work-immutable-rootfs-v2-3-88dd1c34a204@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
54 lines
1.2 KiB
C
54 lines
1.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#include <linux/kernel.h>
|
|
#include <linux/blkdev.h>
|
|
#include <linux/init.h>
|
|
#include <linux/syscalls.h>
|
|
#include <linux/unistd.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/mount.h>
|
|
#include <linux/major.h>
|
|
#include <linux/root_dev.h>
|
|
#include <linux/init_syscalls.h>
|
|
#include <linux/task_work.h>
|
|
#include <linux/file.h>
|
|
|
|
void mount_root_generic(char *name, char *pretty_name, int flags);
|
|
void mount_root(char *root_device_name);
|
|
extern int root_mountflags;
|
|
extern bool nullfs_rootfs;
|
|
|
|
static inline __init int create_dev(char *name, dev_t dev)
|
|
{
|
|
init_unlink(name);
|
|
return init_mknod(name, S_IFBLK | 0600, new_encode_dev(dev));
|
|
}
|
|
|
|
#ifdef CONFIG_BLK_DEV_RAM
|
|
|
|
int __init rd_load_disk(int n);
|
|
int __init rd_load_image(char *from);
|
|
|
|
#else
|
|
|
|
static inline int rd_load_disk(int n) { return 0; }
|
|
static inline int rd_load_image(char *from) { return 0; }
|
|
|
|
#endif
|
|
|
|
#ifdef CONFIG_BLK_DEV_INITRD
|
|
bool __init initrd_load(char *root_device_name);
|
|
#else
|
|
static inline bool initrd_load(char *root_device_name)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
#endif
|
|
|
|
/* Ensure that async file closing finished to prevent spurious errors. */
|
|
static inline void init_flush_fput(void)
|
|
{
|
|
flush_delayed_fput();
|
|
task_work_run();
|
|
}
|