From 074a2c181eba6c5b1dbb7cfb6a1fda0d3eb07f43 Mon Sep 17 00:00:00 2001
From: Chris Hofstaedtler <ch@grml.org>
Date: Wed, 25 Jun 2025 21:33:56 +0200
Subject: [PATCH 1/2] Better isolate new chroot from host /dev, /dev/pts,
 /run/udev

Closes: #1108311

Thanks: Wolfgang Zarre <lxdev12@zirdeon.com>
---
 grml-debootstrap | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/grml-debootstrap b/grml-debootstrap
index 37893c6..7f29249 100755
--- a/grml-debootstrap
+++ b/grml-debootstrap
@@ -1814,12 +1814,6 @@ iface ${interface} inet dhcp
       bailout 1
     fi
   fi
-
-  if [ -d /run/udev ] ; then
-    einfo "Setting up bind-mount /run/udev"
-    mkdir -p "${MNTPOINT}"/run/udev
-    mount --bind /run/udev "${MNTPOINT}"/run/udev
-  fi
 }
 # }}}
 
@@ -1879,8 +1873,11 @@ chrootscript() {
     eend 1
   else
     einfo "Executing chroot-script now"
-    mount -t devtmpfs udev "${MNTPOINT}"/dev
-    mount -t devpts devpts "${MNTPOINT}"/dev/pts
+    # Linux kernel only has a *single* instance of devtmpfs. Mounting it
+    # with -t devtmpfs will give the chroot the *same* instance as the host has.
+    # To avoid modifying the host /dev, we provide a read-only bind mount.
+    mount -o bind,ro /dev "${MNTPOINT}"/dev
+    mount -t devpts -o newinstance devpts "${MNTPOINT}"/dev/pts
     if [ "$DEBUG" = "true" ] ; then
       clean_chroot "$MNTPOINT" /bin/bash -x /bin/chroot-script
     else

From f9eb51417cb6d51703641a2b7373073e7f5d445a Mon Sep 17 00:00:00 2001
From: Chris Hofstaedtler <ch@grml.org>
Date: Thu, 26 Jun 2025 00:26:49 +0200
Subject: [PATCH 2/2] debug

---
 chroot-script | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/chroot-script b/chroot-script
index fd2f1f8..99604ba 100755
--- a/chroot-script
+++ b/chroot-script
@@ -783,6 +783,12 @@ grub_install() {
     return 1
   fi
 
+  echo 'XXXXXXXXXXXXX mount output follows'
+  mount
+  echo 'XXXXXXXXXXXXX grub.cfg follows'
+  cat /boot/grub/grub.cfg
+  echo 'XXXXXXXXXXXXX end'
+
   if mountpoint -q /boot/efi ; then
     umount /boot/efi
   fi