summaryrefslogtreecommitdiff
path: root/src/nspawn.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2011-07-23 15:54:52 +0200
committerLennart Poettering <lennart@poettering.net>2011-07-23 15:54:52 +0200
commit4b7a6af440ee1a957fd8fe1c6ca3b7f310fdf77c (patch)
tree772a09e266e6b3a9e3b46e817d2cb57fa92f8f2a /src/nspawn.c
parente1ea662c3393f479312436fc2d50ebd30f2466ef (diff)
nspawn: mount a new /proc instance in the container so that we don't see the hosts' PID tree
This partially reverts f5c1b9eeb94c112e5dac09fc6a47c571356c30c0.
Diffstat (limited to 'src/nspawn.c')
-rw-r--r--src/nspawn.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/nspawn.c b/src/nspawn.c
index 8f3cd749e5..8d7e0d03a9 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -124,7 +124,7 @@ static int mount_all(const char *dest) {
} MountPoint;
static const MountPoint mount_table[] = {
- { "/proc", "/proc", "bind", NULL, MS_BIND, true },
+ { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true },
{ "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */
{ "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */
{ "/sys", "/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */