From 18de1a273e00fd87205e174e2bfe3c36837a6d37 Mon Sep 17 00:00:00 2001 From: Alexander Morozov Date: Fri, 17 Jul 2015 12:45:09 -0700 Subject: [PATCH] Remount /sys/fs/cgroup as readonly always Signed-off-by: Alexander Morozov --- libcontainer/integration/exec_test.go | 18 ++++++++++++++++++ libcontainer/rootfs_linux.go | 6 ++++++ 2 files changed, 24 insertions(+) diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go index ae7ecc41..77e1e436 100644 --- a/libcontainer/integration/exec_test.go +++ b/libcontainer/integration/exec_test.go @@ -845,6 +845,15 @@ func TestMountCgroupRO(t *testing.T) { mountInfo := buffers.Stdout.String() lines := strings.Split(mountInfo, "\n") for _, l := range lines { + if strings.HasPrefix(l, "tmpfs on /sys/fs/cgroup") { + if !strings.Contains(l, "ro,nosuid,nodev,noexec") { + t.Fatalf("Mode expected to contain 'ro,nosuid,nodev,noexec': %s", l) + } + if !strings.Contains(l, "mode=755") { + t.Fatalf("Mode expected to contain 'mode=755': %s", l) + } + continue + } if !strings.HasPrefix(l, "cgroup") { continue } @@ -880,6 +889,15 @@ func TestMountCgroupRW(t *testing.T) { mountInfo := buffers.Stdout.String() lines := strings.Split(mountInfo, "\n") for _, l := range lines { + if strings.HasPrefix(l, "tmpfs on /sys/fs/cgroup") { + if !strings.Contains(l, "ro,nosuid,nodev,noexec") { + t.Fatalf("Mode expected to contain 'ro,nosuid,nodev,noexec': %s", l) + } + if !strings.Contains(l, "mode=755") { + t.Fatalf("Mode expected to contain 'mode=755': %s", l) + } + continue + } if !strings.HasPrefix(l, "cgroup") { continue } diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index a211d8de..fb388acc 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -196,6 +196,7 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error { Device: "tmpfs", Destination: m.Destination, Flags: defaultMountFlags, + Data: "mode=755", } if err := mountToRootfs(tmpfs, rootfs, mountLabel); err != nil { return err @@ -205,6 +206,11 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error { return err } } + // remount cgroup root as readonly + rootfsCgroup := filepath.Join(rootfs, m.Destination) + if err := syscall.Mount("", rootfsCgroup, "", defaultMountFlags|syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil { + return err + } default: return fmt.Errorf("unknown mount device %q to %q", m.Device, m.Destination) }