/dev/shm, shared memory 'sem_open: Permission denied', prevent writing to /etc/fstab

phabricator-migrator · February 19, 2024, 5:48pm

Information

ID: 369
PHID: PHID-TASK-cr762krdg3sjodam5oah
Author: Patrick
Status at Migration Time: invalid
Priority at Migration Time: Normal

Description

Issue with:

github.com

nrgaway/qubes-template-whonix/blob/169249cc18853e2e8bd44c409939a79399528625/whonix-gateway/02_install_groups_pre.sh#L104-107


      
          sudo ~/whonix_build_post $@
          EOF
          
          # ==============================================================================
          # chroot Whonix post build script
          # ==============================================================================
          read -r -d '' WHONIX_BUILD_SCRIPT_POST <<'EOF' || true
          #!/bin/bash -e
          # vim: set ts=4 sw=4 sts=4 et :
          
          # Prevents Whonix makefile use of shared memory 'sem_open: Permission denied'
          # ------------------------------------------------------------------------------
          echo tmpfs /dev/shm tmpfs defaults 0 0 >> /etc/fstab
          mount /dev/shm
          
          # =============================================================================
          # WHONIX BUILD COMMAND
          # =============================================================================
          pushd /home/user/Whonix
          /home/user/Whonix/whonix_build \
              --flavor $1 \

Prevents Whonix makefile use of shared memory ‘sem_open: Permission denied’

Nope. Whonix’s build scripts are just bash scripts. No C/asm code. Terms like /dev/shm, shared memory or sem_open weren’t on my mind, so no code is consciously making use of such stuff.

I think a simple call of dpkg-parsechangelog caused this.

Writing to /etc/fstab should be avoided.

If mounting of /dev/shm is required in chroot, it should be done during the chroot setup / unsetup. Not where currently.

Comments

Patrick

2015-09-05 15:53:07 UTC

This is related to deterministic packages and Whonix’s use of faketime, which requires writing to /dev/shm.

To trigger this issue.
sudo -u user /home/user/Whonix/packages/anon-apt-sources-list/debian/gain-root-command debian/rules clean
Or unspecific to any packaging / Whonix.
sudo -u user faketime -f "2013-08-15 11:02:35" echo test
sem_open: Permission denied
Workaround.
chmod o+w /dev/shm
The real solution is using a proper way to create deterministic packages. This means waiting until the Debian ReproducibleBuilds toolchain has been merged into Debian.

Patrick

2017-01-18 08:22:00 UTC