diff options
| author | Lennart Poettering <lennart@poettering.net> | 2011-07-23 15:54:52 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2011-07-23 15:54:52 +0200 |
| commit | 4b7a6af440ee1a957fd8fe1c6ca3b7f310fdf77c (patch) | |
| tree | 772a09e266e6b3a9e3b46e817d2cb57fa92f8f2a /src/nspawn.c | |
| parent | e1ea662c3393f479312436fc2d50ebd30f2466ef (diff) | |
nspawn: mount a new /proc instance in the container so that we don't see the hosts' PID tree
This partially reverts f5c1b9eeb94c112e5dac09fc6a47c571356c30c0.
Diffstat (limited to 'src/nspawn.c')
| -rw-r--r-- | src/nspawn.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/nspawn.c b/src/nspawn.c index 8f3cd749e5..8d7e0d03a9 100644 --- a/src/nspawn.c +++ b/src/nspawn.c @@ -124,7 +124,7 @@ static int mount_all(const char *dest) { } MountPoint; static const MountPoint mount_table[] = { - { "/proc", "/proc", "bind", NULL, MS_BIND, true }, + { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true }, { "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */ { "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */ { "/sys", "/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */ |