summaryrefslogtreecommitdiff
path: root/src/nspawn/nspawn-mount.h
diff options
context:
space:
mode:
authorIago López Galeiras <iaguis@gmail.com>2015-10-15 12:13:13 +0200
committerIago López Galeiras <iaguis@gmail.com>2015-10-20 10:19:23 +0200
commitd167824896e583ffaca891b1c355ff852496ff66 (patch)
tree7a5e78bc85ee51a3b1639e8ffa75133eaff55ae8 /src/nspawn/nspawn-mount.h
parentec566e4c7cee67ec2c39475ef08f18a9f1b80efd (diff)
nspawn: skip /sys-as-tmpfs if we don't use private-network
Since v3.11/7dc5dbc ("sysfs: Restrict mounting sysfs"), the kernel doesn't allow mounting sysfs if you don't have CAP_SYS_ADMIN rights over the network namespace. So the mounting /sys as a tmpfs code introduced in d8fc6a000fe21b0c1ba27fbfed8b42d00b349a4b doesn't work with user namespaces if we don't use private-net. The reason is that we mount sysfs inside the container and we're in the network namespace of the host but we don't have CAP_SYS_ADMIN over that namespace. To fix that, we mount /sys as a sysfs (instead of tmpfs) if we don't use private network and ignore the /sys-as-a-tmpfs code if we find that /sys is already mounted as sysfs. Fixes #1555
Diffstat (limited to 'src/nspawn/nspawn-mount.h')
-rw-r--r--src/nspawn/nspawn-mount.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/nspawn/nspawn-mount.h b/src/nspawn/nspawn-mount.h
index 54cab87665..bdab23bcca 100644
--- a/src/nspawn/nspawn-mount.h
+++ b/src/nspawn/nspawn-mount.h
@@ -57,7 +57,7 @@ int tmpfs_mount_parse(CustomMount **l, unsigned *n, const char *s);
int custom_mount_compare(const void *a, const void *b);
-int mount_all(const char *dest, bool use_userns, bool in_userns, uid_t uid_shift, uid_t uid_range, const char *selinux_apifs_context);
+int mount_all(const char *dest, bool use_userns, bool in_userns, bool use_netns, uid_t uid_shift, uid_t uid_range, const char *selinux_apifs_context);
int mount_sysfs(const char *dest);
int mount_cgroups(const char *dest, bool unified_requested, bool userns, uid_t uid_shift, uid_t uid_range, const char *selinux_apifs_context);