opencontainers/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2025-11-09 13:00:56 +03:00
Code Activity

chroot when no mount namespaces is provided

Browse Source 
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This commit is contained in:
Michael Crosby
2018-01-25 11:36:37 -05:00
parent c4e4bb0df2
commit 91ca331474
2 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libcontainer/rootfs_linux.go
View File

@@ -100,8 +100,10 @@ func prepareRootfs(pipe io.ReadWriter, iConfig *initConfig) (err error) {
if config.NoPivotRoot { if config.NoPivotRoot {
err = msMoveRoot(config.Rootfs) err = msMoveRoot(config.Rootfs)
} else { } else if config.Namespaces.Contains(configs.NEWNS) {
err = pivotRoot(config.Rootfs) err = pivotRoot(config.Rootfs)
} else {
err = chroot(config.Rootfs)
} }
if err != nil { if err != nil {
return newSystemErrorWithCause(err, "jailing process inside rootfs") return newSystemErrorWithCause(err, "jailing process inside rootfs")
@@ -702,6 +704,10 @@ func msMoveRoot(rootfs string) error {
if err := unix.Mount(rootfs, "/", "", unix.MS_MOVE, ""); err != nil { if err := unix.Mount(rootfs, "/", "", unix.MS_MOVE, ""); err != nil {
return err return err
} }
return chroot(rootfs)
}
func chroot(rootfs string) error {
if err := unix.Chroot("."); err != nil { if err := unix.Chroot("."); err != nil {
return err return err
} }

5
libcontainer/standard_init_linux.go
View File

@@ -65,14 +65,9 @@ func (l *linuxStandardInit) Init() error {
} }
label.Init() label.Init()
// prepareRootfs() can be executed only for a new mount namespace.
if l.config.Config.Namespaces.Contains(configs.NEWNS) {
if err := prepareRootfs(l.pipe, l.config); err != nil { if err := prepareRootfs(l.pipe, l.config); err != nil {
return err return err
} }
}
// Set up the console. This has to be done *before* we finalize the rootfs, // Set up the console. This has to be done *before* we finalize the rootfs,
// but *after* we've given the user the chance to set up all of the mounts // but *after* we've given the user the chance to set up all of the mounts
// they wanted. // they wanted.