Bug#762759: switchsh: Can't bind mount over a symlink, thus program only works by accident

[Matthew Gabeler-Lee]

Package: switchsh
Version: 0~20070801-3.1
Severity: important
Tags: upstream

Debian now uses a symlink for /bin/sh, and unless the local administrator
overrides this, that makes switchsh totally non-functional.

When attempting to bind mount over a symlink, the symlink gets resolved.
Thus when switchsh attempts to bind mount /bin/bash over /bin/sh, it really
ends up bind mounting /bin/bash over whatever /bin/sh points to.

Since /bin/sh still points to that, it has the overall desired effect, but
it's not really doing what was intended. Also, any script that might
explicitly have attempted to use whatever interpreter /bin/sh links to, will
now get bash instead.

-- System Information:
Debian Release: jessie/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.14-2-amd64 (SMP w/12 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages switchsh depends on:
ii libc6 2.19-11

switchsh recommends no packages.

switchsh suggests no packages.

-- no debconf information

[Jakub Wilk]

It's not documented in any obvious place, but it's actually possible to
persuade mount(2) not to follow symlinks. See my proof of concept code
here: https://github.com/jwilk/symount

I stole the idea from Aleksa Sarai:
https://lore.kernel.org/all/20191230052036.8765-1-***@cyphar.com/

The linked mail from 2019 proposed removal of this feature, but
evidently the removal didn't happen. And now that systemd uses the trick
extensively¹, I don't think there's any danger it'll go away in the
future.

¹ https://github.com/systemd/systemd/commit/28126409b20bca9a

[наб]

Control: tags -1 + patch

Post by Jakub Wilk
It's not documented in any obvious place, but it's actually possible to
https://github.com/jwilk/symount

Using this methodology makes for an easy patch, attached.

Best,