summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2011-07-13 21:57:56 +0200
committerLennart Poettering <lennart@poettering.net>2011-07-13 21:57:56 +0200
commitf5c1b9eeb94c112e5dac09fc6a47c571356c30c0 (patch)
tree81a31bc8db597e35155855d9bc6e468b6ef432cd
parent2eb916cdff570a2ce741fc9b40d7316a77c57c27 (diff)
nspawn: always use bind mounts to make API file systems available in the container
This ensures that read-only flags are never passed from the container to the host OS.
-rw-r--r--src/nspawn.c16
1 files changed, 11 insertions, 5 deletions
diff --git a/src/nspawn.c b/src/nspawn.c
index 50d7c2e289..8ee940c2be 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -124,15 +124,17 @@ static int mount_all(const char *dest) {
} MountPoint;
static const MountPoint mount_table[] = {
- { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
- { "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */
- { "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */
- { "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true },
+ { "/proc", "/proc", "bind", NULL, MS_BIND, true },
+ { "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */
+ { "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */
+ { "/sys", "/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */
+ { "/sys", "/sys", "bind", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */
{ "tmpfs", "/dev", "tmpfs", "mode=755", MS_NOSUID, true },
{ "/dev/pts", "/dev/pts", "bind", NULL, MS_BIND, true },
{ "tmpfs", "/run", "tmpfs", "mode=755", MS_NOSUID|MS_NODEV, true },
#ifdef HAVE_SELINUX
- { "selinux", "/selinux", "selinuxfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, false },
+ { "/selinux", "/selinux", "bind", NULL, MS_BIND, false }, /* Bind mount first */
+ { "/selinux", "/selinux", "selinuxfs", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, false }, /* Then, make it r/o */
#endif
};
@@ -739,6 +741,10 @@ int main(int argc, char *argv[]) {
if (prctl(PR_SET_PDEATHSIG, SIGKILL) < 0)
goto child_fail;
+ /* Mark / as private, in case somebody marked it shared */
+ if (mount(NULL, "/", NULL, MS_PRIVATE|MS_REC, NULL) < 0)
+ goto child_fail;
+
if (mount_all(arg_directory) < 0)
goto child_fail;