diff options
| author | Lennart Poettering <lennart@poettering.net> | 2015-09-30 13:47:28 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2015-09-30 15:19:33 +0200 |
| commit | d8fc6a000fe21b0c1ba27fbfed8b42d00b349a4b (patch) | |
| tree | 7b21fcfde83588969aebf609e0ad835566a4358a /src/nspawn/nspawn.c | |
| parent | 403af78c8049358496ec10920b3aaf741056daf9 (diff) | |
nspawn: mount /sys as tmpfs, and then mount only select subdirs of the real sysfs below it
This way we can hide things like /sys/firmware or /sys/hypervisor from
the container, while keeping the device tree around.
While this is a security benefit in itself it also allows us to fix
issue #1277.
Previously we'd mount /sys before creating the user namespace, in order
to be able to mount /sys/fs/cgroup/* beneath it (which resides in it),
which we can only mount outside of the user namespace. To ensure that
the user namespace owns the network namespace we'd set up the network
namespace at the same time as the user namespace. Thus, we'd still see
the /sys/class/net/ from the originating network namespace, even though
we are in our own network namespace now. With this patch, /sys is
mounted before transitioning into the user namespace as tmpfs, so that
we can also mount /sys/fs/cgroup/* into it this early. The directories
such as /sys/class/ are then later added in from the real sysfs from
inside the network and user namespace so that they actually show whatis
available in it.
Fixes #1277
Diffstat (limited to 'src/nspawn/nspawn.c')
| -rw-r--r-- | src/nspawn/nspawn.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 9f60f41b98..f4a2e3d9ba 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -2454,6 +2454,10 @@ static int inner_child( if (r < 0) return r; + r = mount_sysfs(NULL); + if (r < 0) + return r; + /* Wait until we are cgroup-ified, so that we * can mount the right cgroup path writable */ if (!barrier_place_and_sync(barrier)) { /* #3 */ |