add bindexec

Author: DrDaveD

ChangeLog

@@ -1,3 +1,7 @@
+- Add a bindexec command.
+- Stop using $TMPDIR as a temporary variable name in cvmfsexec because it
+  might be already set and exported.
+
 cvmfsexec-4.46 - 2 April 2025
 - Go back to selecting the cvmfs version from the egi and osg distribution.
 - Properly sort the cvmfs version number from the downloaded list of packages.

README.md

@@ -42,6 +42,10 @@ do this in 4 different ways:
    unprivileged user namespaces enabled,
    this can also be used with unprivileged singularity or apptainer.
 
+In addition, this package contains a related tool called
+[bindexec](#bindexec) which starts a new user namespace with given
+bind mounts added.
+
 # Supported operating systems
 
 Operating systems currently supported by this package are Red Hat
@@ -370,3 +374,40 @@ $ mkfs.ext3 -F -O ^has_journal -d tmp scratch.img
 By default the cvmfs logs are written to a top-level `log` directory, alongside
 the top-level `dist` directory. The variable `SINGCVMFS_LOGDIR` can be used to
 write them to a different directory, which will be created if it doesn't exist.
+
+# bindexec
+
+As a bonus, this package also includes a separate tool called `bindexec`
+that accepts any set of bind mounts to add into a new unprivileged user
+mount namespace.  The usage is much like `cvmfsexec` except that instead
+of cvmfs repository names you give it `src:dest` pairs where `src` is a
+source directory or file and `dest` is a destination path.  For example:
+
+```
+$ bindexec /etc/motd:/var/lib/mydir/motd -- ls /var/lib/mydir
+motd
+```
+
+Like `cvmfsexec`, if no command is supplied after `--` it runs an
+interactive shell.
+
+Bind mounts require target destinations to exist, but if they are
+missing `bindexec` will automatically create them.  This requires the
+fuse-overlayfs command to be in the PATH, although if there is demand
+for it a script for making that easily distributable as well will be
+supplied (probably through a `makedist` option).
+
+Some system directories (`/proc`, `/sys`, `/dev`, and `/run`) are
+included as-is on top of the overlay so anything bound into those
+directories will not appear.  In addition, any `nfs` filesystem types
+are automatically added on top of the overlay because they don't work
+properly through overlay, so no bind mounts will appear in those paths
+either.
+
+`bindexec` always creates a new process namespace because that's the
+easiest way to make sure that the fuse-overlayfs process will exit when
+the command exits.  This means that processes start over at pid 1 and no
+process can be seen outside of the namespace.  Also because it is using
+an unprivileged user namespace, any files owned by anyone other than the
+current user will show up as being owned by `nobody` (just as it does in
+`cvmfsexec`).

cvmfsexec

@@ -39,13 +39,13 @@ elif [ "$MAJORKERN" -eq 3 -a "$MINORKERN" -eq 10 -a "$REVKERN" -ge 1127 ]; then
     USERFUSE=true
 fi
 
-TMPDIR=$(mktemp -d)
-trap "rm -rf $TMPDIR" 0  # note that trap does not carry past exec
-CMDFIFO1=$TMPDIR/cmd1
-WAITFIFO1=$TMPDIR/wait1
-CMDFIFO2=$TMPDIR/cmd2
-WAITFIFO2=$TMPDIR/wait2
-FUNCS=$TMPDIR/funcs
+TMPD=$(mktemp -d)
+trap "rm -rf $TMPD" 0  # note that trap does not carry past exec
+CMDFIFO1=$TMPD/cmd1
+WAITFIFO1=$TMPD/wait1
+CMDFIFO2=$TMPD/cmd2
+WAITFIFO2=$TMPD/wait2
+FUNCS=$TMPD/funcs
 
 # create the fifos used for interprocess communication
 mkfifo $CMDFIFO1 $WAITFIFO1 $CMDFIFO2 $WAITFIFO2
@@ -238,7 +238,7 @@ else
         fi
         ./umountrepo $REPO >/dev/null
     done
-    rm -rf $TMPDIR
+    rm -rf $TMPD
     ) &
 fi
 
@@ -252,7 +252,7 @@ unshare -rm $UNSHAREOPTS /bin/bash /dev/stdin "${@:-$SHELL}" <<!EOF-1!
     #set -x
     #PS4='c\$$+ '
     # now in the "fakeroot" namespace
-    trap "rm -rf $TMPDIR" 0 # note that this does not carry through "exec"
+    trap "rm -rf $TMPD" 0 # note that this does not carry through "exec"
 
     mkdir -p $HERE/mnt
     mount --rbind $HERE/mnt $HERE/mnt # pivot_root requires this mountpoint
@@ -411,7 +411,7 @@ unshare -rm $UNSHAREOPTS /bin/bash /dev/stdin "${@:-$SHELL}" <<!EOF-1!
             #  processes in the namespaces will get a SIGKILL when
             #  PID 1 exits.
             EXEC=""
-            trap "rm -rf $TMPDIR" 0
+            trap "rm -rf $TMPD" 0
             trap "" 1 2 3 15  # ignore all ordinary signals
         else
             EXEC=exec