newmount 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- newmount-0.1.0/.github/CODEOWNERS +3 -0
- newmount-0.1.0/.github/dependabot.yml +16 -0
- newmount-0.1.0/.github/workflows/ci.yml +59 -0
- newmount-0.1.0/.github/workflows/codeql.yml +35 -0
- newmount-0.1.0/.github/workflows/dependency-review.yml +22 -0
- newmount-0.1.0/.github/workflows/release.yml +63 -0
- newmount-0.1.0/.github/workflows/scorecard.yml +42 -0
- newmount-0.1.0/.github/workflows/zizmor.yml +28 -0
- newmount-0.1.0/.gitignore +11 -0
- newmount-0.1.0/CHANGELOG.md +5 -0
- newmount-0.1.0/CONTRIBUTING.md +19 -0
- newmount-0.1.0/LICENSE +12 -0
- newmount-0.1.0/Makefile +16 -0
- newmount-0.1.0/PKG-INFO +78 -0
- newmount-0.1.0/README.md +50 -0
- newmount-0.1.0/SECURITY.md +6 -0
- newmount-0.1.0/pyproject.toml +114 -0
- newmount-0.1.0/src/newmount/__init__.py +78 -0
- newmount-0.1.0/src/newmount/_syscall.py +228 -0
- newmount-0.1.0/src/newmount/classic.py +144 -0
- newmount-0.1.0/src/newmount/errors.py +10 -0
- newmount-0.1.0/src/newmount/flags.py +208 -0
- newmount-0.1.0/src/newmount/fsapi.py +428 -0
- newmount-0.1.0/src/newmount/py.typed +0 -0
- newmount-0.1.0/tests/__init__.py +1 -0
- newmount-0.1.0/tests/conftest.py +146 -0
- newmount-0.1.0/tests/test_constants.py +148 -0
- newmount-0.1.0/tests/test_errors.py +91 -0
- newmount-0.1.0/tests/test_integration.py +244 -0
- newmount-0.1.0/tests/test_newmount.py +10 -0
- newmount-0.1.0/tests/test_unprivileged.py +163 -0
- newmount-0.1.0/uv.lock +760 -0
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
version: 2
|
|
2
|
+
updates:
|
|
3
|
+
- package-ecosystem: github-actions
|
|
4
|
+
directory: /
|
|
5
|
+
schedule:
|
|
6
|
+
interval: weekly
|
|
7
|
+
cooldown:
|
|
8
|
+
default-days: 7
|
|
9
|
+
open-pull-requests-limit: 5
|
|
10
|
+
- package-ecosystem: uv
|
|
11
|
+
directory: /
|
|
12
|
+
schedule:
|
|
13
|
+
interval: weekly
|
|
14
|
+
cooldown:
|
|
15
|
+
default-days: 7
|
|
16
|
+
open-pull-requests-limit: 5
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [master]
|
|
6
|
+
pull_request:
|
|
7
|
+
schedule:
|
|
8
|
+
- cron: "9 7 * * 1"
|
|
9
|
+
|
|
10
|
+
permissions: {}
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
lint:
|
|
14
|
+
runs-on: ubuntu-latest
|
|
15
|
+
steps:
|
|
16
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
17
|
+
with:
|
|
18
|
+
egress-policy: audit
|
|
19
|
+
|
|
20
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
21
|
+
with:
|
|
22
|
+
persist-credentials: false
|
|
23
|
+
|
|
24
|
+
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
|
25
|
+
with:
|
|
26
|
+
version: "0.11.32"
|
|
27
|
+
enable-cache: true
|
|
28
|
+
|
|
29
|
+
- run: uv sync --locked
|
|
30
|
+
|
|
31
|
+
- run: uv run ruff check .
|
|
32
|
+
- run: uv run ruff format --check .
|
|
33
|
+
- run: uv run bandit -r src/
|
|
34
|
+
- run: uv run mypy
|
|
35
|
+
- run: uvx ty check src tests
|
|
36
|
+
|
|
37
|
+
test:
|
|
38
|
+
runs-on: ubuntu-latest
|
|
39
|
+
strategy:
|
|
40
|
+
fail-fast: false
|
|
41
|
+
matrix:
|
|
42
|
+
python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
|
|
43
|
+
steps:
|
|
44
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
45
|
+
with:
|
|
46
|
+
egress-policy: audit
|
|
47
|
+
|
|
48
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
49
|
+
with:
|
|
50
|
+
persist-credentials: false
|
|
51
|
+
|
|
52
|
+
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
|
53
|
+
with:
|
|
54
|
+
version: "0.11.32"
|
|
55
|
+
enable-cache: true
|
|
56
|
+
|
|
57
|
+
- run: uv python install ${{ matrix.python }}
|
|
58
|
+
- run: uv sync --locked --python ${{ matrix.python }}
|
|
59
|
+
- run: uv run pytest --cov
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
name: CodeQL
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [master]
|
|
6
|
+
pull_request:
|
|
7
|
+
schedule:
|
|
8
|
+
- cron: "17 3 * * 4"
|
|
9
|
+
|
|
10
|
+
permissions: {}
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
analyze:
|
|
14
|
+
runs-on: ubuntu-latest
|
|
15
|
+
permissions:
|
|
16
|
+
actions: read
|
|
17
|
+
contents: read
|
|
18
|
+
security-events: write
|
|
19
|
+
steps:
|
|
20
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
21
|
+
with:
|
|
22
|
+
egress-policy: audit
|
|
23
|
+
|
|
24
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
25
|
+
with:
|
|
26
|
+
persist-credentials: false
|
|
27
|
+
|
|
28
|
+
- uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
29
|
+
with:
|
|
30
|
+
languages: python
|
|
31
|
+
queries: security-and-quality
|
|
32
|
+
|
|
33
|
+
- uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
34
|
+
with:
|
|
35
|
+
category: "/language:python"
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
name: Dependency Review
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
pull_request:
|
|
5
|
+
|
|
6
|
+
permissions: {}
|
|
7
|
+
|
|
8
|
+
jobs:
|
|
9
|
+
dependency-review:
|
|
10
|
+
runs-on: ubuntu-latest
|
|
11
|
+
permissions:
|
|
12
|
+
contents: read
|
|
13
|
+
steps:
|
|
14
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
15
|
+
with:
|
|
16
|
+
egress-policy: audit
|
|
17
|
+
|
|
18
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
19
|
+
with:
|
|
20
|
+
persist-credentials: false
|
|
21
|
+
|
|
22
|
+
- uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
name: Release
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
tags: ["v*"]
|
|
6
|
+
|
|
7
|
+
permissions: {}
|
|
8
|
+
|
|
9
|
+
jobs:
|
|
10
|
+
release:
|
|
11
|
+
runs-on: ubuntu-latest
|
|
12
|
+
environment:
|
|
13
|
+
name: pypi
|
|
14
|
+
url: https://pypi.org/p/newmount
|
|
15
|
+
permissions:
|
|
16
|
+
contents: write
|
|
17
|
+
id-token: write
|
|
18
|
+
attestations: write
|
|
19
|
+
steps:
|
|
20
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
21
|
+
with:
|
|
22
|
+
egress-policy: audit
|
|
23
|
+
|
|
24
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
25
|
+
with:
|
|
26
|
+
persist-credentials: false
|
|
27
|
+
|
|
28
|
+
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
|
29
|
+
with:
|
|
30
|
+
version: "0.11.32"
|
|
31
|
+
|
|
32
|
+
- run: uv sync --locked
|
|
33
|
+
|
|
34
|
+
- name: Verify tag matches package version
|
|
35
|
+
run: |
|
|
36
|
+
tag="${GITHUB_REF_NAME#v}"
|
|
37
|
+
version="$(uv run python -c 'import newmount; print(newmount.__version__)')"
|
|
38
|
+
if [ "$tag" != "$version" ]; then
|
|
39
|
+
echo "tag $tag does not match package version $version" >&2
|
|
40
|
+
exit 1
|
|
41
|
+
fi
|
|
42
|
+
|
|
43
|
+
- run: uv build
|
|
44
|
+
|
|
45
|
+
- name: Attest build provenance
|
|
46
|
+
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
|
|
47
|
+
with:
|
|
48
|
+
subject-path: dist/*
|
|
49
|
+
|
|
50
|
+
- uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
|
|
51
|
+
with:
|
|
52
|
+
attestations: true
|
|
53
|
+
|
|
54
|
+
- name: Create GitHub release
|
|
55
|
+
env:
|
|
56
|
+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
57
|
+
run: |
|
|
58
|
+
gh release create "${GITHUB_REF_NAME}" \
|
|
59
|
+
--repo "${GITHUB_REPOSITORY}" \
|
|
60
|
+
--verify-tag \
|
|
61
|
+
--title "${GITHUB_REF_NAME}" \
|
|
62
|
+
--generate-notes \
|
|
63
|
+
dist/*
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
name: OpenSSF Scorecard
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
branch_protection_rule:
|
|
5
|
+
push:
|
|
6
|
+
branches: [master]
|
|
7
|
+
workflow_dispatch:
|
|
8
|
+
schedule:
|
|
9
|
+
- cron: "42 5 * * 6"
|
|
10
|
+
|
|
11
|
+
permissions: read-all
|
|
12
|
+
|
|
13
|
+
jobs:
|
|
14
|
+
analysis:
|
|
15
|
+
runs-on: ubuntu-latest
|
|
16
|
+
permissions:
|
|
17
|
+
security-events: write
|
|
18
|
+
id-token: write
|
|
19
|
+
steps:
|
|
20
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
21
|
+
with:
|
|
22
|
+
egress-policy: audit
|
|
23
|
+
|
|
24
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
25
|
+
with:
|
|
26
|
+
persist-credentials: false
|
|
27
|
+
|
|
28
|
+
- uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
|
|
29
|
+
with:
|
|
30
|
+
results_file: results.sarif
|
|
31
|
+
results_format: sarif
|
|
32
|
+
publish_results: true
|
|
33
|
+
|
|
34
|
+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
35
|
+
with:
|
|
36
|
+
name: SARIF file
|
|
37
|
+
path: results.sarif
|
|
38
|
+
retention-days: 5
|
|
39
|
+
|
|
40
|
+
- uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
41
|
+
with:
|
|
42
|
+
sarif_file: results.sarif
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
name: zizmor
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [master]
|
|
6
|
+
paths: [.github/**]
|
|
7
|
+
pull_request:
|
|
8
|
+
paths: [.github/**]
|
|
9
|
+
|
|
10
|
+
permissions: {}
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
zizmor:
|
|
14
|
+
runs-on: ubuntu-latest
|
|
15
|
+
permissions:
|
|
16
|
+
security-events: write
|
|
17
|
+
steps:
|
|
18
|
+
- uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
|
|
19
|
+
with:
|
|
20
|
+
egress-policy: audit
|
|
21
|
+
|
|
22
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
23
|
+
with:
|
|
24
|
+
persist-credentials: false
|
|
25
|
+
|
|
26
|
+
- uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
|
|
27
|
+
with:
|
|
28
|
+
advanced-security: false
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
# Contributing
|
|
2
|
+
|
|
3
|
+
Report bugs through GitHub issues. Security reports go to
|
|
4
|
+
security@quad4.io (see SECURITY.md).
|
|
5
|
+
|
|
6
|
+
## Setup
|
|
7
|
+
|
|
8
|
+
uv sync
|
|
9
|
+
make check
|
|
10
|
+
|
|
11
|
+
`make check` runs the full local gate: ruff lint and format, bandit,
|
|
12
|
+
mypy strict, ty, and pytest with coverage.
|
|
13
|
+
|
|
14
|
+
## Conventions
|
|
15
|
+
|
|
16
|
+
- No runtime dependencies unless the project genuinely needs one.
|
|
17
|
+
- Source files start with the SPDX license identifier.
|
|
18
|
+
- Public API changes need tests.
|
|
19
|
+
- Commit messages: short, imperative, formal.
|
newmount-0.1.0/LICENSE
ADDED
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
Copyright (c) 2026 Quad4
|
|
2
|
+
|
|
3
|
+
Permission to use, copy, modify, and/or distribute this software for any purpose
|
|
4
|
+
with or without fee is hereby granted.
|
|
5
|
+
|
|
6
|
+
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
7
|
+
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
8
|
+
FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
9
|
+
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
10
|
+
LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
11
|
+
OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
12
|
+
PERFORMANCE OF THIS SOFTWARE.
|
newmount-0.1.0/Makefile
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
.PHONY: check lint test build
|
|
2
|
+
|
|
3
|
+
check: lint test
|
|
4
|
+
|
|
5
|
+
lint:
|
|
6
|
+
uv run ruff check .
|
|
7
|
+
uv run ruff format --check .
|
|
8
|
+
uv run bandit -r src/
|
|
9
|
+
uv run mypy
|
|
10
|
+
uvx ty check src tests
|
|
11
|
+
|
|
12
|
+
test:
|
|
13
|
+
uv run pytest --cov --cov-report=term-missing
|
|
14
|
+
|
|
15
|
+
build:
|
|
16
|
+
uv build
|
newmount-0.1.0/PKG-INFO
ADDED
|
@@ -0,0 +1,78 @@
|
|
|
1
|
+
Metadata-Version: 2.5
|
|
2
|
+
Name: newmount
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Python bindings for the Linux mount API
|
|
5
|
+
Project-URL: Homepage, https://quad4.io
|
|
6
|
+
Project-URL: Repository, https://github.com/Quad4-Software/newmount
|
|
7
|
+
Project-URL: Issues, https://github.com/Quad4-Software/newmount/issues
|
|
8
|
+
Project-URL: Changelog, https://github.com/Quad4-Software/newmount/blob/master/CHANGELOG.md
|
|
9
|
+
Author: Quad4
|
|
10
|
+
License-Expression: 0BSD
|
|
11
|
+
License-File: LICENSE
|
|
12
|
+
Keywords: filesystems,fsopen,linux,mount,namespaces
|
|
13
|
+
Classifier: Development Status :: 4 - Beta
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: License :: OSI Approved :: BSD License
|
|
16
|
+
Classifier: Operating System :: POSIX :: Linux
|
|
17
|
+
Classifier: Programming Language :: Python :: 3
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
22
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
23
|
+
Classifier: Topic :: Security
|
|
24
|
+
Classifier: Topic :: System :: Operating System Kernels :: Linux
|
|
25
|
+
Classifier: Typing :: Typed
|
|
26
|
+
Requires-Python: >=3.10
|
|
27
|
+
Description-Content-Type: text/markdown
|
|
28
|
+
|
|
29
|
+
# newmount
|
|
30
|
+
|
|
31
|
+
[](https://github.com/Quad4-Software/newmount/actions/workflows/ci.yml)
|
|
32
|
+
[](https://github.com/Quad4-Software/newmount/actions/workflows/codeql.yml)
|
|
33
|
+
[](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/newmount)
|
|
34
|
+
[](https://pypi.org/project/newmount/)
|
|
35
|
+
[](LICENSE)
|
|
36
|
+
|
|
37
|
+
Dependency-free ctypes bindings for the Linux mount API: the classic
|
|
38
|
+
mount(2)/umount2(2) calls, and the new mount API (kernel 5.2+) built on
|
|
39
|
+
fsopen, fsconfig, fsmount, open_tree, move_mount, fspick and
|
|
40
|
+
mount_setattr.
|
|
41
|
+
|
|
42
|
+
Requires Python 3.10+ and Linux. Mounting needs CAP_SYS_ADMIN; an
|
|
43
|
+
unprivileged process gets there inside a user+mount namespace
|
|
44
|
+
(`unshare -Urm`).
|
|
45
|
+
|
|
46
|
+
## Install
|
|
47
|
+
|
|
48
|
+
pip install newmount
|
|
49
|
+
|
|
50
|
+
## Example: classic bind mount
|
|
51
|
+
|
|
52
|
+
import newmount
|
|
53
|
+
|
|
54
|
+
# bind recursively, then remount read-only
|
|
55
|
+
newmount.bind("/srv/data", "/mnt/data", readonly=True)
|
|
56
|
+
|
|
57
|
+
## Example: clone, reconfigure and attach with the new API
|
|
58
|
+
|
|
59
|
+
import newmount
|
|
60
|
+
|
|
61
|
+
# clone the tree, flip the clone read-only, attach it
|
|
62
|
+
with newmount.open_tree_clone("/srv/data") as tree:
|
|
63
|
+
tree.apply_attrs(set=newmount.MOUNT_ATTR_RDONLY)
|
|
64
|
+
tree.attach("/mnt/data")
|
|
65
|
+
|
|
66
|
+
# or build a fresh filesystem from scratch
|
|
67
|
+
with newmount.FsContext("tmpfs") as ctx:
|
|
68
|
+
ctx.set("size", "16m")
|
|
69
|
+
ctx.create()
|
|
70
|
+
with ctx.mount() as mnt:
|
|
71
|
+
mnt.attach("/mnt/scratch")
|
|
72
|
+
|
|
73
|
+
## Development
|
|
74
|
+
|
|
75
|
+
uv sync --group dev
|
|
76
|
+
make check
|
|
77
|
+
|
|
78
|
+
License: 0BSD. Quad4 Software, https://quad4.io
|
newmount-0.1.0/README.md
ADDED
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
# newmount
|
|
2
|
+
|
|
3
|
+
[](https://github.com/Quad4-Software/newmount/actions/workflows/ci.yml)
|
|
4
|
+
[](https://github.com/Quad4-Software/newmount/actions/workflows/codeql.yml)
|
|
5
|
+
[](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/newmount)
|
|
6
|
+
[](https://pypi.org/project/newmount/)
|
|
7
|
+
[](LICENSE)
|
|
8
|
+
|
|
9
|
+
Dependency-free ctypes bindings for the Linux mount API: the classic
|
|
10
|
+
mount(2)/umount2(2) calls, and the new mount API (kernel 5.2+) built on
|
|
11
|
+
fsopen, fsconfig, fsmount, open_tree, move_mount, fspick and
|
|
12
|
+
mount_setattr.
|
|
13
|
+
|
|
14
|
+
Requires Python 3.10+ and Linux. Mounting needs CAP_SYS_ADMIN; an
|
|
15
|
+
unprivileged process gets there inside a user+mount namespace
|
|
16
|
+
(`unshare -Urm`).
|
|
17
|
+
|
|
18
|
+
## Install
|
|
19
|
+
|
|
20
|
+
pip install newmount
|
|
21
|
+
|
|
22
|
+
## Example: classic bind mount
|
|
23
|
+
|
|
24
|
+
import newmount
|
|
25
|
+
|
|
26
|
+
# bind recursively, then remount read-only
|
|
27
|
+
newmount.bind("/srv/data", "/mnt/data", readonly=True)
|
|
28
|
+
|
|
29
|
+
## Example: clone, reconfigure and attach with the new API
|
|
30
|
+
|
|
31
|
+
import newmount
|
|
32
|
+
|
|
33
|
+
# clone the tree, flip the clone read-only, attach it
|
|
34
|
+
with newmount.open_tree_clone("/srv/data") as tree:
|
|
35
|
+
tree.apply_attrs(set=newmount.MOUNT_ATTR_RDONLY)
|
|
36
|
+
tree.attach("/mnt/data")
|
|
37
|
+
|
|
38
|
+
# or build a fresh filesystem from scratch
|
|
39
|
+
with newmount.FsContext("tmpfs") as ctx:
|
|
40
|
+
ctx.set("size", "16m")
|
|
41
|
+
ctx.create()
|
|
42
|
+
with ctx.mount() as mnt:
|
|
43
|
+
mnt.attach("/mnt/scratch")
|
|
44
|
+
|
|
45
|
+
## Development
|
|
46
|
+
|
|
47
|
+
uv sync --group dev
|
|
48
|
+
make check
|
|
49
|
+
|
|
50
|
+
License: 0BSD. Quad4 Software, https://quad4.io
|
|
@@ -0,0 +1,114 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["hatchling"]
|
|
3
|
+
build-backend = "hatchling.build"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "newmount"
|
|
7
|
+
dynamic = ["version"]
|
|
8
|
+
description = "Python bindings for the Linux mount API"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
requires-python = ">=3.10"
|
|
11
|
+
license = "0BSD"
|
|
12
|
+
authors = [{ name = "Quad4" }]
|
|
13
|
+
keywords = ["mount", "linux", "fsopen", "namespaces", "filesystems"]
|
|
14
|
+
classifiers = [
|
|
15
|
+
"Development Status :: 4 - Beta",
|
|
16
|
+
"Intended Audience :: Developers",
|
|
17
|
+
"License :: OSI Approved :: BSD License",
|
|
18
|
+
"Operating System :: POSIX :: Linux",
|
|
19
|
+
"Programming Language :: Python :: 3",
|
|
20
|
+
"Programming Language :: Python :: 3.10",
|
|
21
|
+
"Programming Language :: Python :: 3.11",
|
|
22
|
+
"Programming Language :: Python :: 3.12",
|
|
23
|
+
"Programming Language :: Python :: 3.13",
|
|
24
|
+
"Programming Language :: Python :: 3.14",
|
|
25
|
+
"Topic :: Security",
|
|
26
|
+
"Topic :: System :: Operating System Kernels :: Linux",
|
|
27
|
+
"Typing :: Typed",
|
|
28
|
+
]
|
|
29
|
+
dependencies = []
|
|
30
|
+
|
|
31
|
+
[project.urls]
|
|
32
|
+
Homepage = "https://quad4.io"
|
|
33
|
+
Repository = "https://github.com/Quad4-Software/newmount"
|
|
34
|
+
Issues = "https://github.com/Quad4-Software/newmount/issues"
|
|
35
|
+
Changelog = "https://github.com/Quad4-Software/newmount/blob/master/CHANGELOG.md"
|
|
36
|
+
|
|
37
|
+
[tool.hatch.version]
|
|
38
|
+
path = "src/newmount/__init__.py"
|
|
39
|
+
|
|
40
|
+
[dependency-groups]
|
|
41
|
+
dev = [
|
|
42
|
+
"pytest>=9.1.1",
|
|
43
|
+
"pytest-cov>=7.1.0",
|
|
44
|
+
"ruff>=0.16.8",
|
|
45
|
+
"bandit>=1.9.4",
|
|
46
|
+
"mypy>=2.3.1",
|
|
47
|
+
]
|
|
48
|
+
|
|
49
|
+
[tool.ruff]
|
|
50
|
+
target-version = "py310"
|
|
51
|
+
src = ["src", "tests"]
|
|
52
|
+
|
|
53
|
+
[tool.ruff.lint]
|
|
54
|
+
select = [
|
|
55
|
+
"E", "W", # pycodestyle
|
|
56
|
+
"F", # pyflakes
|
|
57
|
+
"I", # isort
|
|
58
|
+
"N", # pep8-naming
|
|
59
|
+
"UP", # pyupgrade
|
|
60
|
+
"YTT", # sys.version misuse
|
|
61
|
+
"FA", # future annotations
|
|
62
|
+
"A", # builtins shadowing
|
|
63
|
+
"B", # flake8-bugbear
|
|
64
|
+
"BLE", # blind except
|
|
65
|
+
"C4", # comprehensions
|
|
66
|
+
"C90", # mccabe complexity
|
|
67
|
+
"DTZ", # timezone-aware datetimes
|
|
68
|
+
"ERA", # commented-out code
|
|
69
|
+
"FURB", # refurb
|
|
70
|
+
"G", # logging format
|
|
71
|
+
"ICN", # import conventions
|
|
72
|
+
"ISC", # implicit string concat
|
|
73
|
+
"LOG", # logging
|
|
74
|
+
"PERF", # perflint
|
|
75
|
+
"PGH", # pygrep hooks
|
|
76
|
+
"PIE", # misc lints
|
|
77
|
+
"PT", # pytest style
|
|
78
|
+
"PTH", # pathlib
|
|
79
|
+
"RET", # return
|
|
80
|
+
"RSE", # raise/return
|
|
81
|
+
"S", # bandit rules
|
|
82
|
+
"SIM", # simplify
|
|
83
|
+
"SLOT", # __slots__
|
|
84
|
+
"T20", # print
|
|
85
|
+
"TRY", # exception handling
|
|
86
|
+
"RUF", # ruff-specific
|
|
87
|
+
]
|
|
88
|
+
ignore = [
|
|
89
|
+
"ISC001", # single-line implicit concat conflicts with the formatter
|
|
90
|
+
"TRY003", # long messages in raise calls are fine
|
|
91
|
+
]
|
|
92
|
+
|
|
93
|
+
[tool.ruff.lint.per-file-ignores]
|
|
94
|
+
"tests/*" = ["S101", "S603"]
|
|
95
|
+
|
|
96
|
+
[tool.mypy]
|
|
97
|
+
strict = true
|
|
98
|
+
files = ["src", "tests"]
|
|
99
|
+
|
|
100
|
+
[tool.bandit]
|
|
101
|
+
exclude_dirs = ["tests"]
|
|
102
|
+
|
|
103
|
+
[tool.coverage.run]
|
|
104
|
+
branch = true
|
|
105
|
+
source = ["src/newmount"]
|
|
106
|
+
|
|
107
|
+
[tool.coverage.report]
|
|
108
|
+
show_missing = true
|
|
109
|
+
fail_under = 80
|
|
110
|
+
|
|
111
|
+
[tool.pytest.ini_options]
|
|
112
|
+
testpaths = ["tests"]
|
|
113
|
+
xfail_strict = true
|
|
114
|
+
filterwarnings = ["error"]
|
|
@@ -0,0 +1,78 @@
|
|
|
1
|
+
# SPDX-License-Identifier: 0BSD
|
|
2
|
+
"""Python bindings for the Linux mount API.
|
|
3
|
+
|
|
4
|
+
Two layers: the classic mount(2)/umount2(2) calls with helpers like
|
|
5
|
+
bind() and tmpfs(), and the new mount API (kernel 5.2+) built on
|
|
6
|
+
fsopen/fsconfig/fsmount/move_mount/open_tree/fspick/mount_setattr.
|
|
7
|
+
"""
|
|
8
|
+
|
|
9
|
+
from __future__ import annotations
|
|
10
|
+
|
|
11
|
+
from . import flags as flags
|
|
12
|
+
from .classic import (
|
|
13
|
+
bind,
|
|
14
|
+
make_private,
|
|
15
|
+
make_shared,
|
|
16
|
+
make_slave,
|
|
17
|
+
make_unbindable,
|
|
18
|
+
mount,
|
|
19
|
+
mount_proc,
|
|
20
|
+
tmpfs,
|
|
21
|
+
umount,
|
|
22
|
+
umount2,
|
|
23
|
+
)
|
|
24
|
+
from .errors import MountError, UnsupportedError
|
|
25
|
+
from .flags import * # noqa: F403 - re-export the constant namespace
|
|
26
|
+
from .flags import __all__ as _flags_all
|
|
27
|
+
from .fsapi import (
|
|
28
|
+
FsContext,
|
|
29
|
+
MountAttr,
|
|
30
|
+
MountFd,
|
|
31
|
+
Tree,
|
|
32
|
+
apply_attrs,
|
|
33
|
+
attach,
|
|
34
|
+
fsconfig,
|
|
35
|
+
fsmount,
|
|
36
|
+
fsopen,
|
|
37
|
+
fspick,
|
|
38
|
+
mount_setattr,
|
|
39
|
+
move_mount,
|
|
40
|
+
new_api_supported,
|
|
41
|
+
open_tree,
|
|
42
|
+
open_tree_clone,
|
|
43
|
+
)
|
|
44
|
+
|
|
45
|
+
__version__ = "0.1.0"
|
|
46
|
+
|
|
47
|
+
__all__ = [
|
|
48
|
+
"FsContext",
|
|
49
|
+
"MountAttr",
|
|
50
|
+
"MountError",
|
|
51
|
+
"MountFd",
|
|
52
|
+
"Tree",
|
|
53
|
+
"UnsupportedError",
|
|
54
|
+
"__version__",
|
|
55
|
+
"apply_attrs",
|
|
56
|
+
"attach",
|
|
57
|
+
"bind",
|
|
58
|
+
"flags",
|
|
59
|
+
"fsconfig",
|
|
60
|
+
"fsmount",
|
|
61
|
+
"fsopen",
|
|
62
|
+
"fspick",
|
|
63
|
+
"make_private",
|
|
64
|
+
"make_shared",
|
|
65
|
+
"make_slave",
|
|
66
|
+
"make_unbindable",
|
|
67
|
+
"mount",
|
|
68
|
+
"mount_proc",
|
|
69
|
+
"mount_setattr",
|
|
70
|
+
"move_mount",
|
|
71
|
+
"new_api_supported",
|
|
72
|
+
"open_tree",
|
|
73
|
+
"open_tree_clone",
|
|
74
|
+
"tmpfs",
|
|
75
|
+
"umount",
|
|
76
|
+
"umount2",
|
|
77
|
+
*_flags_all,
|
|
78
|
+
]
|