|
 |
43fe83 |
From 36b51f3b1f6129a29abdee018d5d63f6ae37b586 Mon Sep 17 00:00:00 2001
|
|
|
43fe83 |
Message-Id: <36b51f3b1f6129a29abdee018d5d63f6ae37b586.1380112456.git.jdenemar@redhat.com>
|
|
|
43fe83 |
From: Gao feng <gaofeng@cn.fujitsu.com>
|
|
|
43fe83 |
Date: Fri, 20 Sep 2013 13:07:48 +0100
|
|
|
43fe83 |
Subject: [PATCH] LXC: Don't mount securityfs when user namespace enabled
|
|
|
43fe83 |
|
|
|
43fe83 |
For
|
|
|
43fe83 |
|
|
|
43fe83 |
https://bugzilla.redhat.com/show_bug.cgi?id=872648
|
|
|
43fe83 |
|
|
|
43fe83 |
Right now, securityfs is disallowed to be mounted in non-initial
|
|
|
43fe83 |
user namespace, so we must avoid trying to mount securityfs in
|
|
|
43fe83 |
a container which has user namespace enabled.
|
|
|
43fe83 |
|
|
|
43fe83 |
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
|
|
|
43fe83 |
(cherry picked from commit 1583dfda7c4e5ad71efe0615c06e5676528d8203)
|
|
|
43fe83 |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
43fe83 |
---
|
|
|
43fe83 |
src/lxc/lxc_container.c | 7 +++++--
|
|
|
43fe83 |
1 file changed, 5 insertions(+), 2 deletions(-)
|
|
|
43fe83 |
|
|
|
43fe83 |
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
|
|
|
43fe83 |
index 8abaea0..c41ab40 100644
|
|
|
43fe83 |
--- a/src/lxc/lxc_container.c
|
|
|
43fe83 |
+++ b/src/lxc/lxc_container.c
|
|
|
43fe83 |
@@ -750,7 +750,7 @@ err:
|
|
|
43fe83 |
}
|
|
|
43fe83 |
|
|
|
43fe83 |
|
|
|
43fe83 |
-static int lxcContainerMountBasicFS(void)
|
|
|
43fe83 |
+static int lxcContainerMountBasicFS(bool userns_enabled)
|
|
|
43fe83 |
{
|
|
|
43fe83 |
const struct {
|
|
|
43fe83 |
const char *src;
|
|
|
43fe83 |
@@ -801,6 +801,9 @@ static int lxcContainerMountBasicFS(void)
|
|
|
43fe83 |
continue;
|
|
|
43fe83 |
#endif
|
|
|
43fe83 |
|
|
|
43fe83 |
+ if (STREQ(mnts[i].src, "securityfs") && userns_enabled)
|
|
|
43fe83 |
+ continue;
|
|
|
43fe83 |
+
|
|
|
43fe83 |
if (virFileMakePath(mnts[i].dst) < 0) {
|
|
|
43fe83 |
virReportSystemError(errno,
|
|
|
43fe83 |
_("Failed to mkdir %s"),
|
|
|
43fe83 |
@@ -1530,7 +1533,7 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef,
|
|
|
43fe83 |
goto cleanup;
|
|
|
43fe83 |
|
|
|
43fe83 |
/* Mounts the core /proc, /sys, etc filesystems */
|
|
|
43fe83 |
- if (lxcContainerMountBasicFS() < 0)
|
|
|
43fe83 |
+ if (lxcContainerMountBasicFS(vmDef->idmap.nuidmap) < 0)
|
|
|
43fe83 |
goto cleanup;
|
|
|
43fe83 |
|
|
|
43fe83 |
/* Mounts /proc/meminfo etc sysinfo */
|
|
|
43fe83 |
--
|
|
|
43fe83 |
1.8.3.2
|
|
|
43fe83 |
|