container/podman
container/podman
1
0
Fork 0
mirror of https://github.com/containers/podman synced 2024-10-20 01:03:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

rootless: don't bind mount /sys/fs/cgroup/systemd in systemd mode

Browse source 
it is not writeable by non-root users so there is no point in having
access to it from a container.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano 2018-11-05 20:02:50 +01:00
parent 9150d69087
commit 11c5b0237b
No known key found for this signature in database
GPG key ID: E4730F97F60286ED
1 changed files with 15 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
libpod/container_internal_linux.go
View file

@ -360,19 +360,23 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(tmpfsMnt)
}
cgroupPath, err := c.CGroupPath()
if err != nil {
return err
}
sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath)
// rootless containers have no write access to /sys/fs/cgroup, so don't
// add any mount into the container.
if !rootless.IsRootless() {
cgroupPath, err := c.CGroupPath()
if err != nil {
return err
}
sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath)
systemdMnt := spec.Mount{
Destination: "/sys/fs/cgroup/systemd",
Type: "bind",
Source: sourcePath,
Options: []string{"bind", "private"},
systemdMnt := spec.Mount{
Destination: "/sys/fs/cgroup/systemd",
Type: "bind",
Source: sourcePath,
Options: []string{"bind", "private"},
}
g.AddMount(systemdMnt)
}
g.AddMount(systemdMnt)
return nil
}