From: Michael Biebl <biebl@debian.org>
Date: Thu, 4 Sep 2014 23:15:16 +0000 (+0200)
Subject: Make /run/lock tmpfs an API fs
X-Git-Tag: archive/raspbian/241-7_deb10u7+rpi1^2~14
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=9de4b41b74624adcdfb3d65efbcabbfc0d17450b;p=systemd.git

Make /run/lock tmpfs an API fs

The /run/lock directory is world-writable in Debian due to historic
reasons. To avoid user processes filling up /run, we mount a separate
tmpfs for /run/lock. As this directory needs to be available during
early boot, we make it an API fs.

Drop it from tmpfiles.d/legacy.conf to not clobber the permissions.

Closes: #751392

Gbp-Pq: Topic debian
Gbp-Pq: Name Make-run-lock-tmpfs-an-API-fs.patch
---

diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c
index 3ce6164b..3aae4c86 100644
--- a/src/core/mount-setup.c
+++ b/src/core/mount-setup.c
@@ -83,6 +83,8 @@ static const MountPoint mount_table[] = {
 #endif
         { "tmpfs",       "/run",                      "tmpfs",      "mode=755",                MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
+        { "tmpfs",       "/run/lock",                 "tmpfs",      "mode=1777,size=5242880",  MS_NOSUID|MS_NODEV|MS_NOEXEC,
+          NULL,          MNT_FATAL|MNT_IN_CONTAINER },
         { "cgroup2",     "/sys/fs/cgroup",            "cgroup2",    "nsdelegate",              MS_NOSUID|MS_NOEXEC|MS_NODEV,
           cg_is_unified_wanted, MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
         { "cgroup2",     "/sys/fs/cgroup",            "cgroup2",    NULL,                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
diff --git a/tmpfiles.d/legacy.conf b/tmpfiles.d/legacy.conf
index 62e2ae09..ea5e735e 100644
--- a/tmpfiles.d/legacy.conf
+++ b/tmpfiles.d/legacy.conf
@@ -10,7 +10,6 @@
 # These files are considered legacy and are unnecessary on legacy-free
 # systems.
 
-d /run/lock 0755 root root -
 L /var/lock - - - - ../run/lock
 
 # /run/lock/subsys is used for serializing SysV service execution, and