pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-01-27 09:37:13 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

sops-install-secrets: use noswap mount option with tmpfs

Browse source
This commit is contained in:
Amine Hassane 2025-08-24 23:16:34 +01:00 • committed by Jörg Thalheim
parent edb2a27167
commit 41430cca9d
5 changed files with 23 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

21
pkgs/sops-install-secrets/linux.go
View file

@ -4,10 +4,12 @@
package main
import (
"errors"
"fmt"
"os"
"golang.org/x/sys/unix"
"github.com/moby/sys/mountinfo"
)
func RuntimeDir() (string, error) {
@ -30,18 +32,31 @@ func MountSecretFs(mountpoint string, keysGID int, useTmpfs bool, userMode bool)
var fstype = "ramfs"
var fsmagic = RamfsMagic
var fsoptions = "mode=0751"
if useTmpfs {
fstype = "tmpfs"
fsmagic = TmpfsMagic
fsoptions += ",noswap"
}
buf := unix.Statfs_t{}
if err := unix.Statfs(mountpoint, &buf); err != nil {
return fmt.Errorf("cannot get statfs for directory '%s': %w", mountpoint, err)
}
if int32(buf.Type) != fsmagic {
if err := unix.Mount("none", mountpoint, fstype, unix.MS_NODEV|unix.MS_NOSUID, "mode=0751"); err != nil {
return fmt.Errorf("cannot mount: %w", err)
mounted, err := mountinfo.Mounted(mountpoint)
if err != nil {
return fmt.Errorf("cannot check if directory '%s' is a mountpoint: %w", mountpoint, err)
}
if !mounted || int32(buf.Type) != fsmagic {
flags := uintptr(unix.MS_NODEV | unix.MS_NOSUID | unix.MS_NOEXEC)
if err := unix.Mount("none", mountpoint, fstype, flags, fsoptions); err != nil {
if useTmpfs && errors.Is(err, unix.EINVAL) {
if err := unix.Mount("none", mountpoint, fstype, flags, "mode=0751"); err != nil {
return fmt.Errorf("cannot mount (fallback without noswap failed): %w", err)
}
} else {
return fmt.Errorf("cannot mount: %w", err)
}
}
}