[Buildd-tools-devel] Bug#369626: schroot: rm -rf in file chroot cleanup destroys real /home if umount fails

[Andreas Bombe]

Package: schroot
Version: 0.2.10-1
Severity: critical
Justification: causes serious data loss

The session cleanup in 10mount ignores failures of umount invocations
and cleanup continues.  In the case of file chroots with a /home bind
mount that failed to umount, the rm -rf in 05file blindly descends into
the system /home with obvious unpretty results.

The bind mount may fail to umount whenever something gets mounted under
the bind.  In my case I was foolishly trying to rbind instead of bind
/home in 10mount because my $HOME is a separate mount, and I wanted to
have it available in the chroot.


Apart from making a failed umount abort the session cleanup, I see as
another possible solution to rm -rf only a bind mount of the chroot to
be sure there are no sub mounts, then umount this and only rmdir the
actual chroot.  This would fail harmlessly if umounts failed (results
only in a leftover session to be manually cleaned up).


-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (990, 'unstable'), (500, 'testing'), (1, 'experimental')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/dash
Kernel: Linux 2.6.16-1-k7
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)

Versions of packages schroot depends on:
ii  libboost-prog 1.33.1-4                   program options library for C++
ii  libc6         2.3.6-9                    GNU C Library: Shared libraries
ii  libgcc1       1:4.1.0-4                  GCC support library
ii  liblockdev1   1.0.3-1                    Run-time shared library for lockin
ii  libpam0g      0.79-3.1                   Pluggable Authentication Modules l
ii  libstdc++6    4.1.0-4                    The GNU Standard C++ Library v3
ii  libuuid1      1.38+1.39-WIP-2006.04.09-2 universally unique id library

schroot recommends no packages.

-- no debconf information