system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-10-04 15:21:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #26646 from poettering/nspawn-private

Browse source 
nspawn: ensure all mount propagation is turned off between host and container, except for the "tunnel" dir
This commit is contained in:
Luca Boccassi 2023-03-03 15:57:13 +00:00 committed by GitHub
parent 4ed17fb88c 56339a10db
commit 0c70d5e623
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/nspawn/nspawn-mount.c
View file

@ -598,6 +598,8 @@ int mount_all(const char *dest,
MOUNT_FATAL }, /* If /etc/os-release doesn't exist use the version in /usr/lib as fallback */
{ NULL, "/run/host/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
MOUNT_FATAL },
{ NULL, "/run/host/os-release", NULL, NULL, MS_PRIVATE,
MOUNT_FATAL }, /* Turn off propagation (we only want that for the mount propagation tunnel dir) */
{ NULL, "/run/host", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
MOUNT_FATAL|MOUNT_IN_USERNS },
#if HAVE_SELINUX
@ -605,6 +607,8 @@ int mount_all(const char *dest,
MOUNT_MKDIR }, /* Bind mount first (mkdir/chown the mount point in case /sys/ is mounted as minimal skeleton tmpfs) */
{ NULL, "/sys/fs/selinux", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT,
0 }, /* Then, make it r/o (don't mkdir/chown the mount point here, the previous entry already did that) */
{ NULL, "/sys/fs/selinux", NULL, NULL, MS_PRIVATE,
0 }, /* Turn off propagation (we only want that for the mount propagation tunnel dir) */
#endif
};

18
src/nspawn/nspawn.c
View file

@ -3758,6 +3758,19 @@ static int outer_child(
directory = "/run/systemd/nspawn-root";
}
/* Make sure we always have a mount that we can move to root later on. */
r = make_mount_point(directory);
if (r < 0)
return r;
/* So the whole tree is now MS_SLAVE, i.e. we'll still receive mount/umount events from the host
* mount namespace. For the directory we are going to run our container let's turn this off, so that
* we'll live in our own little world from now on, and propagation from the host may only happen via
* the mount tunnel dir, or not at all. */
r = mount_follow_verbose(LOG_ERR, NULL, directory, NULL, MS_PRIVATE|MS_REC, NULL);
if (r < 0)
return r;
r = setup_pivot_root(
directory,
arg_pivot_root_new,
@ -3815,11 +3828,6 @@ static int outer_child(
if (r < 0)
return r;
/* Make sure we always have a mount that we can move to root later on. */
r = make_mount_point(directory);
if (r < 0)
return r;
if (arg_userns_mode != USER_NAMESPACE_NO &&
IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) &&
arg_uid_shift != 0) {