From 4b7a6af440ee1a957fd8fe1c6ca3b7f310fdf77c Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sat, 23 Jul 2011 15:54:52 +0200 Subject: nspawn: mount a new /proc instance in the container so that we don't see the hosts' PID tree This partially reverts f5c1b9eeb94c112e5dac09fc6a47c571356c30c0. --- src/nspawn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/nspawn.c b/src/nspawn.c index 8f3cd749e5..8d7e0d03a9 100644 --- a/src/nspawn.c +++ b/src/nspawn.c @@ -124,7 +124,7 @@ static int mount_all(const char *dest) { } MountPoint; static const MountPoint mount_table[] = { - { "/proc", "/proc", "bind", NULL, MS_BIND, true }, + { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, true }, { "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */ { "/proc/sys", "/proc/sys", "bind", NULL, MS_BIND|MS_RDONLY|MS_REMOUNT, true }, /* Then, make it r/o */ { "/sys", "/sys", "bind", NULL, MS_BIND, true }, /* Bind mount first */ -- cgit v1.2.3-54-g00ecf