diff options
| -rw-r--r-- | src/nspawn/nspawn.c | 55 |
1 files changed, 24 insertions, 31 deletions
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 2c3fc4659a..5c4341e0ee 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -2674,15 +2674,15 @@ static int inner_child( assert(directory); assert(kmsg_socket >= 0); - if (arg_userns_mode != USER_NAMESPACE_NO) { - /* Tell the parent, that it now can write the UID map. */ - (void) barrier_place(barrier); /* #1 */ + /* Tell the parent that it can now configure our process; write + * the UID map (if use_userns), place us in the correct cgroup (if + * use_cgns), et c. */ + (void) barrier_place(barrier); /* #1 */ - /* Wait until the parent wrote the UID map */ - if (!barrier_place_and_sync(barrier)) { /* #2 */ - log_error("Parent died too early"); - return -ESRCH; - } + /* Wait until the parent says that we are fully configured. */ + if (!barrier_place_and_sync(barrier)) { /* #2 */ + log_error("Parent died too early"); + return -ESRCH; } r = reset_uid_gid(); @@ -2702,13 +2702,6 @@ static int inner_child( if (r < 0) return r; - /* Wait until we are cgroup-ified, so that we - * can mount the right cgroup path writable */ - if (!barrier_place_and_sync(barrier)) { /* #3 */ - log_error("Parent died too early"); - return -ESRCH; - } - if (arg_use_cgns) { r = unshare(CLONE_NEWCGROUP); if (r < 0) @@ -2814,7 +2807,7 @@ static int inner_child( /* Let the parent know that we are ready and * wait until the parent is ready with the * setup, too... */ - if (!barrier_place_and_sync(barrier)) { /* #4 */ + if (!barrier_place_and_sync(barrier)) { /* #3 */ log_error("Parent died too early"); return -ESRCH; } @@ -3765,12 +3758,6 @@ static int run(int master, } } - /* Wait for the outer child. */ - r = wait_for_terminate_and_warn("namespace helper", *helper_pid, NULL); - *helper_pid = 0; - if (r != 0) - return r < 0 ? r : -EIO; - /* And now retrieve the PID of the inner child. */ l = recv(pid_socket_pair[0], main_pid, sizeof *main_pid, 0); if (l < 0) @@ -3797,17 +3784,16 @@ static int run(int master, log_debug("Init process invoked as PID "PID_FMT, *main_pid); - if (arg_userns_mode != USER_NAMESPACE_NO) { - if (!barrier_place_and_sync(&barrier)) { /* #1 */ - log_error("Child died too early."); - return -ESRCH; - } + /* Wait until the child gives us the OK to configure it. */ + if (!barrier_place_and_sync(&barrier)) { /* #1 */ + log_error("Child died too early."); + return -ESRCH; + } + if (arg_userns_mode != USER_NAMESPACE_NO) { r = setup_uid_map(*main_pid); if (r < 0) return r; - - (void) barrier_place(&barrier); /* #2 */ } if (arg_private_network) { @@ -3881,11 +3867,18 @@ static int run(int master, if (r < 0) return r; + + /* Wait for the outer child. */ + r = wait_for_terminate_and_warn("namespace helper", *helper_pid, NULL); + *helper_pid = 0; + if (r != 0) + return r < 0 ? r : -EIO; + /* Notify the child that the parent is ready with all * its setup (including cgroup-ification), and that * the child can now hand over control to the code to * run inside the container. */ - (void) barrier_place(&barrier); /* #3 */ + (void) barrier_place(&barrier); /* #2 */ /* Block SIGCHLD here, before notifying child. * process_pty() will handle it with the other signals. */ @@ -3905,7 +3898,7 @@ static int run(int master, return r; /* Let the child know that we are ready and wait that the child is completely ready now. */ - if (!barrier_place_and_sync(&barrier)) { /* #4 */ + if (!barrier_place_and_sync(&barrier)) { /* #3 */ log_error("Child died too early."); return -ESRCH; } |