V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4000_debootstrap/4010_prepare_mounts.sh

@@ -15,9 +15,10 @@ guard_sourcing
 #######################################
 # Configure the target system for chroot.
 # Globals:
-#   ERR_CHRT_MOUNTS
 #   TARGET
 #   VAR_CHROOT_ACTIVATED
+#   VAR_CHROOT_SYS_MASK_ENTER
+#   VAR_CHROOT_SYS_MASK_LEAVE
 #   VAR_NEED_RUN_IN_TARGET
 # Arguments:
 #   None
@@ -53,6 +54,73 @@ prepare_mounts() {
 
   declare     var_path="" var_fs="" var_src="" var_opts=""
 
+  # shellcheck disable=SC2034
+  declare -g  VAR_CHROOT_SYS_MASK_ENTER=""
+  # shellcheck disable=SC2034
+  VAR_CHROOT_SYS_MASK_ENTER=$(cat <<'EOF'
+declare var_had_sys="0"
+
+if mountpoint -q /sys/fs/cgroup; then
+  umount -l /sys/fs/cgroup || {
+    printf 'ERROR: cannot umount /sys/fs/cgroup\n' >&2
+    return 128
+  }
+fi
+
+if mountpoint -q /sys; then
+  var_had_sys="1"
+  umount -l /sys || {
+    printf 'ERROR: cannot umount /sys\n' >&2
+    return 129
+  }
+fi
+
+mkdir -p /run
+printf '%s\n' "${var_had_sys}" >| /run/.ciss_sysmask  ### 1 = had sysfs, 0 = none
+
+mkdir -p /sys
+### Empty, read-only directory so tools that expect /sys to exist don't fail.
+if ! mount -t tmpfs -o ro,nosuid,nodev,noexec,mode=0555,size=1M tmpfs /sys; then
+  printf 'ERROR: cannot mount tmpfs on /sys\n' >&2
+  return 130
+fi
+EOF
+  )
+
+  # shellcheck disable=SC2034
+  declare -g  VAR_CHROOT_SYS_MASK_LEAVE=""
+  # shellcheck disable=SC2034
+  VAR_CHROOT_SYS_MASK_LEAVE=$(cat <<'EOF'
+declare var_had_sys="0"
+
+if [[ -f /run/.ciss_sysmask ]]; then
+  # shellcheck disable=SC2155
+  declare var_had_sys="$(cat /run/.ciss_sysmask 2>/dev/null || printf '0')"
+fi
+
+if mountpoint -q /sys; then
+  umount -l /sys || {
+    printf 'ERROR: cannot unmount masked /sys\n' >&2
+    return 131
+  }
+fi
+
+### Restore sysfs and cgroup2.
+if ! mount -t sysfs -o nosuid,noexec,nodev sysfs /sys; then
+  printf 'ERROR: cannot mount sysfs on /sys\n' >&2
+  return 132
+fi
+
+mkdir -p /sys/fs/cgroup
+if ! mount -t cgroup2 -o rw,nosuid,nodev,noexec,relatime cgroup2 /sys/fs/cgroup; then
+  printf 'ERROR: cannot mount cgroup2 on /sys/fs/cgroup\n' >&2
+  return 133
+fi
+
+rm -f /run/.ciss_sysmask
+EOF
+  )
+
   for var_path in "${!HMP_SPECIAL_MOUNTS[@]}"; do
 
     mkdir -p "${TARGET}${var_path}"