Control: tags -1 + upstream
Control: forwarded -1 https://github.com/grml/grml-debootstrap/pull/347
On Wed, Jun 25, 2025 at 05:22:07PM +0000, Wolfgang Zarre wrote:
> * What was the outcome of this action?
> Modified ownership on the host in /dev:
> crw-rw---- root systemd-resolve /dev/kvm
> crw-rw---- root systemd-resolve /dev/vhost-net
> crw-rw---- root systemd-resolve /dev/vhost-vsock
>
> * What outcome did you expect instead?
> An unmodified host system.
>
>
>
> The issue was that the package udev was modifying the files in chroot
> during the setup and obviously, any package could do that but it should
> not modify the host system, which in the worst could crash the host system.
>
> This is caused by mounting rw in line 2016: mount -t devtmpfs udev
> "${MNTPOINT}"/dev
> which allows then in chroot to modify files in /dev.
>
> Therefore it would be good to mount "${MNTPOINT}"/dev read-only, e.g.:
> mount -t devtmpfs udev "${MNTPOINT}"/dev -o ro
I tried working on this in https://github.com/grml/grml-debootstrap/pull/347
Unfortunately making the chroot /dev readonly makes resulting VM
images unbootable. update-grub should put root=UUID=... into
grub.cfg (as before), but now puts root=/dev/mapper/loop..., which
cannot work for obvious reasons.
Ideas welcome.
Chris
