summaryrefslogtreecommitdiff
path: root/src/nspawn/nspawn.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2015-09-30 13:47:28 +0200
committerLennart Poettering <lennart@poettering.net>2015-09-30 15:19:33 +0200
commitd8fc6a000fe21b0c1ba27fbfed8b42d00b349a4b (patch)
tree7b21fcfde83588969aebf609e0ad835566a4358a /src/nspawn/nspawn.c
parent403af78c8049358496ec10920b3aaf741056daf9 (diff)
nspawn: mount /sys as tmpfs, and then mount only select subdirs of the real sysfs below it
This way we can hide things like /sys/firmware or /sys/hypervisor from the container, while keeping the device tree around. While this is a security benefit in itself it also allows us to fix issue #1277. Previously we'd mount /sys before creating the user namespace, in order to be able to mount /sys/fs/cgroup/* beneath it (which resides in it), which we can only mount outside of the user namespace. To ensure that the user namespace owns the network namespace we'd set up the network namespace at the same time as the user namespace. Thus, we'd still see the /sys/class/net/ from the originating network namespace, even though we are in our own network namespace now. With this patch, /sys is mounted before transitioning into the user namespace as tmpfs, so that we can also mount /sys/fs/cgroup/* into it this early. The directories such as /sys/class/ are then later added in from the real sysfs from inside the network and user namespace so that they actually show whatis available in it. Fixes #1277
Diffstat (limited to 'src/nspawn/nspawn.c')
-rw-r--r--src/nspawn/nspawn.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 9f60f41b98..f4a2e3d9ba 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -2454,6 +2454,10 @@ static int inner_child(
if (r < 0)
return r;
+ r = mount_sysfs(NULL);
+ if (r < 0)
+ return r;
+
/* Wait until we are cgroup-ified, so that we
* can mount the right cgroup path writable */
if (!barrier_place_and_sync(barrier)) { /* #3 */