mirror of
https://github.com/siderolabs/talos.git
synced 2025-09-17 11:51:12 +02:00
33d1c3e425
For the `trustd`, this change is simple as it doesn't access any files on the host filesystem. For the `apid`, there are more things involved: * `apid.sock` used for internal API calls should be createable by `apid` * `runtime.sock` used for apid to COSI communication should be accessible for `apid` * `machined.sock` used for proxying calls to machined should be as well made available to the `apid`. Plus fixes default permissions for `tmpfs` mountpoints. Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
34 lines
1.6 KiB
Go
34 lines
1.6 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package mount
|
|
|
|
import (
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
// PseudoMountPoints returns the mountpoints required to boot the system.
|
|
func PseudoMountPoints() (mountpoints *Points, err error) {
|
|
pseudo := NewMountPoints()
|
|
pseudo.Set("dev", NewMountPoint("devtmpfs", "/dev", "devtmpfs", unix.MS_NOSUID, "mode=0755"))
|
|
pseudo.Set("proc", NewMountPoint("proc", "/proc", "proc", unix.MS_NOSUID|unix.MS_NOEXEC|unix.MS_NODEV, ""))
|
|
pseudo.Set("sys", NewMountPoint("sysfs", "/sys", "sysfs", 0, ""))
|
|
pseudo.Set("run", NewMountPoint("tmpfs", "/run", "tmpfs", 0, "mode=755"))
|
|
pseudo.Set("system", NewMountPoint("tmpfs", "/system", "tmpfs", 0, "mode=755"))
|
|
pseudo.Set("tmp", NewMountPoint("tmpfs", "/tmp", "tmpfs", 0, "mode=755"))
|
|
|
|
return pseudo, nil
|
|
}
|
|
|
|
// PseudoSubMountPoints returns the mountpoints required to boot the system.
|
|
func PseudoSubMountPoints() (mountpoints *Points, err error) {
|
|
pseudo := NewMountPoints()
|
|
pseudo.Set("devshm", NewMountPoint("tmpfs", "/dev/shm", "tmpfs", unix.MS_NOSUID|unix.MS_NOEXEC|unix.MS_NODEV|unix.MS_RELATIME, ""))
|
|
pseudo.Set("devpts", NewMountPoint("devpts", "/dev/pts", "devpts", unix.MS_NOSUID|unix.MS_NOEXEC, "ptmxmode=000,mode=620,gid=5"))
|
|
pseudo.Set("hugetlb", NewMountPoint("hugetlbfs", "/dev/hugepages", "hugetlbfs", 0, ""))
|
|
pseudo.Set("securityfs", NewMountPoint("securityfs", "/sys/kernel/security", "securityfs", unix.MS_NOSUID|unix.MS_NOEXEC|unix.MS_NODEV|unix.MS_RELATIME, ""))
|
|
|
|
return pseudo, nil
|
|
}
|