From a383724e4202ee9681bd31cb668c44bdbbf83638 Mon Sep 17 00:00:00 2001 From: Zbigniew Jędrzejewski-Szmek Date: Sun, 21 Apr 2013 20:25:01 -0400 Subject: systemd,nspawn: use extended attributes to store metadata All attributes are stored as text, since root_directory is already text, and it seems easier to have all of them in text format. Attributes are written in the trusted. namespace, because the kernel currently does not allow user. attributes on cgroups. This is a PITA, and CAP_SYS_ADMIN is required to *read* the attributes. Alas. A second pipe is opened for the child to signal the parent that the cgroup hierarchy has been set up. --- src/core/mount-setup.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'src/core/mount-setup.c') diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c index e45a6bc1c8..56d358b094 100644 --- a/src/core/mount-setup.c +++ b/src/core/mount-setup.c @@ -68,6 +68,12 @@ typedef struct MountPoint { * other ones we can delay until SELinux and IMA are loaded. */ #define N_EARLY_MOUNT 5 +#ifdef HAVE_XATTR +# define FS_XATTR_OPT ",xattr" +#else +# define FS_XATTR_OPT "" +#endif + static const MountPoint mount_table[] = { { "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, MNT_FATAL|MNT_IN_CONTAINER }, @@ -87,7 +93,7 @@ static const MountPoint mount_table[] = { NULL, MNT_FATAL|MNT_IN_CONTAINER }, { "tmpfs", "/sys/fs/cgroup", "tmpfs", "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME, NULL, MNT_IN_CONTAINER }, - { "cgroup", "/sys/fs/cgroup/systemd", "cgroup", "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV, + { "cgroup", "/sys/fs/cgroup/systemd", "cgroup", "none,name=systemd" FS_XATTR_OPT, MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, MNT_IN_CONTAINER }, { "pstore", "/sys/fs/pstore", "pstore", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV, NULL, MNT_NONE }, -- cgit v1.2.3-54-g00ecf