From 636b664027293628bbb59a58e7ec5d4cd567affb Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 29 Jun 2018 17:13:45 +0200 Subject: [PATCH] linux: drop check for /proc as invalid dest it is now allowed to bind mount /proc. This is useful for rootless containers when the PID namespace is shared with the host. Signed-off-by: Giuseppe Scrivano --- libcontainer/rootfs_linux.go | 2 +- libcontainer/rootfs_linux_test.go | 10 +++++++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 7f852efc..c4c788db 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -413,7 +413,7 @@ func checkMountDestination(rootfs, dest string) error { if err != nil { return err } - if path == "." || !strings.HasPrefix(path, "..") { + if path != "." && !strings.HasPrefix(path, "..") { return fmt.Errorf("%q cannot be mounted because it is located inside %q", dest, invalid) } } diff --git a/libcontainer/rootfs_linux_test.go b/libcontainer/rootfs_linux_test.go index f2453e2b..d755984b 100644 --- a/libcontainer/rootfs_linux_test.go +++ b/libcontainer/rootfs_linux_test.go @@ -9,13 +9,21 @@ import ( ) func TestCheckMountDestOnProc(t *testing.T) { - dest := "/rootfs/proc/" + dest := "/rootfs/proc/sys" err := checkMountDestination("/rootfs", dest) if err == nil { t.Fatal("destination inside proc should return an error") } } +func TestCheckMountDestOnProcChroot(t *testing.T) { + dest := "/rootfs/proc/" + err := checkMountDestination("/rootfs", dest) + if err != nil { + t.Fatal("destination inside proc when using chroot should not return an error") + } +} + func TestCheckMountDestInSys(t *testing.T) { dest := "/rootfs//sys/fs/cgroup" err := checkMountDestination("/rootfs", dest)