+static int mount_dev(BindMount *m) {
+ static const char devnodes[] =
+ "/dev/null\0"
+ "/dev/zero\0"
+ "/dev/full\0"
+ "/dev/random\0"
+ "/dev/urandom\0"
+ "/dev/tty\0";
+
+ struct stat devnodes_stat[6] = {};
+ const char *d;
+ unsigned n = 0;
+ _cleanup_umask_ mode_t u;
+ int r;
+
+ assert(m);
+
+ u = umask(0000);
+
+ /* First: record device mode_t and dev_t */
+ NULSTR_FOREACH(d, devnodes) {
+ r = stat(d, &devnodes_stat[n]);
+ if (r < 0) {
+ if (errno != ENOENT)
+ return -errno;
+ } else {
+ if (!S_ISBLK(devnodes_stat[n].st_mode) &&
+ !S_ISCHR(devnodes_stat[n].st_mode))
+ return -EINVAL;
+ }
+
+ n++;
+ }
+
+ assert(n == ELEMENTSOF(devnodes_stat));
+
+ r = mount("tmpfs", "/dev", "tmpfs", MS_NOSUID|MS_STRICTATIME, "mode=755");
+ if (r < 0)
+ return m->ignore ? 0 : -errno;
+
+
+ mkdir_p("/dev/pts", 0755);
+
+ r = mount("devpts", "/dev/pts", "devpts", MS_NOSUID|MS_NOEXEC, "newinstance,ptmxmode=0666,mode=620,gid=" STRINGIFY(TTY_GID));
+ if (r < 0)
+ return m->ignore ? 0 : -errno;
+
+ mkdir_p("/dev/shm", 0755);
+
+ r = mount("tmpfs", "/dev/shm", "tmpfs", MS_NOSUID|MS_NODEV|MS_STRICTATIME, "mode=1777");
+ if (r < 0)
+ return m->ignore ? 0 : -errno;
+
+ /* Second: actually create it */
+ n = 0;
+ NULSTR_FOREACH(d, devnodes) {
+ if (devnodes_stat[n].st_rdev == 0)
+ continue;
+
+ r = mknod(d, devnodes_stat[n].st_mode, devnodes_stat[n].st_rdev);
+ if (r < 0)
+ return m->ignore ? 0 : -errno;
+
+ n++;
+ }
+
+ dev_setup(NULL);
+
+ return 0;
+}
+
+static int apply_mount(
+ BindMount *m,
+ const char *tmp_dir,
+ const char *var_tmp_dir) {
+