Ensure that login profile data is ephemeral

session_manager_setup.sh

 #!/bin/sh
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 XAUTH=/usr/bin/xauth
 XAUTH_FILE="/var/run/chromelogin.auth"
 SERVER_READY=
 
 user1_handler () {
   echo "received SIGUSR1!"
   SERVER_READY=y
 }
 
 trap user1_handler USR1
 MCOOKIE=$(head -c 8 /dev/urandom | openssl md5)  # speed this up?
 ${XAUTH} -q -f ${XAUTH_FILE} add :0 . ${MCOOKIE}
 
 /sbin/xstart.sh ${XAUTH_FILE} &
 
 export USER=chronos
 export DATA_DIR=/home/${USER}
+export LOGIN_PROFILE_DIR=${DATA_DIR}/Default
 export LOGNAME=${USER}
 export SHELL=/bin/bash
 export HOME=${DATA_DIR}/user
 export DISPLAY=:0.0
 export PATH=/bin:/usr/bin:/usr/local/bin:/usr/bin/X11
 export GTK_IM_MODULE=ibus
 
 XAUTH_FILE=${DATA_DIR}/.Xauthority
 export XAUTHORITY=${XAUTH_FILE}
 
 mkdir -p ${DATA_DIR} && chown ${USER}:${USER} ${DATA_DIR}
 mkdir -p ${HOME} && chown ${USER}:${USER} ${HOME}
 ${XAUTH} -q -f ${XAUTH_FILE} add :0 . ${MCOOKIE} && \
   chown ${USER}:${USER} ${XAUTH_FILE}
 
+# Disallow the login profile from having persistent data until
+# http://code.google.com/p/chromium-os/issues/detail?id=1967 is resolved.
+if mount | grep -q "${LOGIN_PROFILE_DIR} "; then
+  umount -f ${LOGIN_PROFILE_DIR}
+fi
+rm -rf ${LOGIN_PROFILE_DIR}
+mkdir -p ${LOGIN_PROFILE_DIR}
+mount -n -t tmpfs -onodev,noexec,nosuid loginprofile ${LOGIN_PROFILE_DIR}
+chown ${USER}:${USER} ${LOGIN_PROFILE_DIR}
+
 # temporary hack to tell cryptohome that we're doing chrome-login
 touch /tmp/doing-chrome-login
 
 CHROME_DIR="/opt/google/chrome"
 CHROME="$CHROME_DIR/chrome"
 COOKIE_PIPE="/tmp/cookie_pipe"
 
 # xdg-open is used to open downloaded files.
 # It runs sensible-browser, which uses $BROWSER.
 export BROWSER=${CHROME}
@@ skipping 30 matching lines @@
 exec /sbin/session_manager --uid=${USER_ID} --login -- \
     $CHROME --enable-gview \
             --enable-sync \
             --log-level=0 \
             --main-menu-url="http://welcome-cros.appspot.com/menu" \
             --no-first-run \
             --user-data-dir=/home/$USER \
             --profile=user \
             "--cookie-pipe=$COOKIE_PIPE" \
             "${SKIP_OOBE}"