Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1251292

Bug#1108311: grml-debootstrap allows to modify ownership in /dev on the host

Show all headers | View raw

Control: tags -1 + upstream
Control: forwarded -1 https://github.com/grml/grml-debootstrap/pull/347

On Wed, Jun 25, 2025 at 05:22:07PM +0000, Wolfgang Zarre wrote:
>     * What was the outcome of this action?
>       Modified ownership on the host in /dev:
>         crw-rw---- root systemd-resolve /dev/kvm
>         crw-rw---- root systemd-resolve /dev/vhost-net
>         crw-rw---- root systemd-resolve /dev/vhost-vsock
> 
>     * What outcome did you expect instead?
>       An unmodified host system.
> 
> 
> 
> The issue was that the package udev was modifying the files in chroot
> during the setup and obviously, any package could do that but it should
> not modify the host system, which in the worst could crash the host system.
> 
> This is caused by mounting rw in line 2016: mount -t devtmpfs udev "${MNTPOINT}"/dev
> which allows then in chroot to modify files in /dev.
> 
> Therefore it would be good to mount "${MNTPOINT}"/dev read-only, e.g.:
> mount -t devtmpfs udev "${MNTPOINT}"/dev -o ro

I tried working on this in https://github.com/grml/grml-debootstrap/pull/347

Unfortunately making the chroot /dev readonly makes resulting VM 
images unbootable. update-grub should put root=UUID=... into 
grub.cfg (as before), but now puts root=/dev/mapper/loop..., which 
cannot work for obvious reasons.

Ideas welcome.

Chris

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1108311: grml-debootstrap allows to modify ownership in /dev on the host Wolfgang Zarre <lxdev12@zirdeon.com> - 2025-06-25 19:40 +0200
  Bug#1108311: grml-debootstrap allows to modify ownership in /dev on the host Wolfgang Zarre <lxdev12@zirdeon.com> - 2025-06-25 21:20 +0200
  Bug#1108311: grml-debootstrap allows to modify ownership in /dev on the host Chris Hofstaedtler <zeha@debian.org> - 2025-06-28 13:00 +0200
  Bug#1108311: grml-debootstrap allows to modify ownership in /dev on the host Wolfgang Zarre <lxdev12@zirdeon.com> - 2025-06-28 15:10 +0200
  Bug#1108311: grml-debootstrap allows to modify ownership in /dev on the host Wolfgang Zarre <lxdev12@zirdeon.com> - 2025-07-03 11:00 +0200
    Bug#1108311: grml-debootstrap allows to modify ownership in /dev on the host Chris Hofstaedtler <zeha@debian.org> - 2025-07-03 12:40 +0200

csiph-web