jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #145 from LK4D4/sysfs_ro 

Remount /sys/fs/cgroup as RO if MS_RDONLY was passed
This commit is contained in:
Michael Crosby 2015-07-27 09:12:55 -07:00
parent 6485adffaa d89964eed3
commit 4507c068ba
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libcontainer/integration/exec_test.go
View File

@ -845,6 +845,15 @@ func TestMountCgroupRO(t *testing.T) {
mountInfo := buffers.Stdout.String() mountInfo := buffers.Stdout.String()
lines := strings.Split(mountInfo, "\n") lines := strings.Split(mountInfo, "\n")
for _, l := range lines { for _, l := range lines {
if strings.HasPrefix(l, "tmpfs on /sys/fs/cgroup") {
if !strings.Contains(l, "ro,nosuid,nodev,noexec") {
t.Fatalf("Mode expected to contain 'ro,nosuid,nodev,noexec': %s", l)
}
if !strings.Contains(l, "mode=755") {
t.Fatalf("Mode expected to contain 'mode=755': %s", l)
}
continue
}
if !strings.HasPrefix(l, "cgroup") { if !strings.HasPrefix(l, "cgroup") {
continue continue
} }
@ -880,6 +889,15 @@ func TestMountCgroupRW(t *testing.T) {
mountInfo := buffers.Stdout.String() mountInfo := buffers.Stdout.String()
lines := strings.Split(mountInfo, "\n") lines := strings.Split(mountInfo, "\n")
for _, l := range lines { for _, l := range lines {
if strings.HasPrefix(l, "tmpfs on /sys/fs/cgroup") {
if !strings.Contains(l, "rw,nosuid,nodev,noexec") {
t.Fatalf("Mode expected to contain 'rw,nosuid,nodev,noexec': %s", l)
}
if !strings.Contains(l, "mode=755") {
t.Fatalf("Mode expected to contain 'mode=755': %s", l)
}
continue
}
if !strings.HasPrefix(l, "cgroup") { if !strings.HasPrefix(l, "cgroup") {
continue continue
} }

8
libcontainer/rootfs_linux.go
View File

@ -186,6 +186,7 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
Device: "tmpfs", Device: "tmpfs",
Destination: m.Destination, Destination: m.Destination,
Flags: defaultMountFlags, Flags: defaultMountFlags,
Data: "mode=755",
} }
if err := mountToRootfs(tmpfs, rootfs, mountLabel); err != nil { if err := mountToRootfs(tmpfs, rootfs, mountLabel); err != nil {
return err return err
@ -218,6 +219,13 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error {
if err := os.Chdir(cwd); err != nil { if err := os.Chdir(cwd); err != nil {
return err return err
} }
if m.Flags&syscall.MS_RDONLY != 0 {
// remount cgroup root as readonly
rootfsCgroup := filepath.Join(rootfs, m.Destination)
if err := syscall.Mount("", rootfsCgroup, "", defaultMountFlags|syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil {
return err
}
}
default: default:
return fmt.Errorf("unknown mount device %q to %q", m.Device, m.Destination) return fmt.Errorf("unknown mount device %q to %q", m.Device, m.Destination)
} }