|
 |
be81ba |
From 8681757ee08361d78e4c74da8abae9d6df8623e7 Mon Sep 17 00:00:00 2001
|
|
|
be81ba |
From: Karel Zak <kzak@redhat.com>
|
|
|
be81ba |
Date: Mon, 28 May 2018 15:46:28 +0200
|
|
|
be81ba |
Subject: [PATCH 62/63] libmount: accept another flags on MS_REMOUNT|MS_BIND
|
|
|
be81ba |
|
|
|
be81ba |
The current libmount MS_REMOUNT|MS_BIND support is restricted to
|
|
|
be81ba |
MS_RDONLY (read-only bind mount). This is too restrictive as Linux
|
|
|
be81ba |
kernel supports bind-remount for arbitrary VFS flags.
|
|
|
be81ba |
|
|
|
be81ba |
After this update you can use
|
|
|
be81ba |
|
|
|
be81ba |
# mount /dev/sdc1 /mnt/A
|
|
|
be81ba |
# mount --bind -onosuid,noexec /mnt/A /mnt/B
|
|
|
be81ba |
|
|
|
be81ba |
# findmnt /dev/sdc1 -oTARGET,SOURCE,FS-OPTIONS,VFS-OPTIONS
|
|
|
be81ba |
TARGET SOURCE FS-OPTIONS VFS-OPTIONS
|
|
|
be81ba |
/mnt/A /dev/sdc1 rw,stripe=512,data=ordered rw,relatime
|
|
|
be81ba |
/mnt/B /dev/sdc1 rw,stripe=512,data=ordered rw,nosuid,noexec,relatime
|
|
|
be81ba |
|
|
|
be81ba |
The "mount --bind" is composed from two syscalls of course (1st is
|
|
|
be81ba |
bind, 2nd is bind,remount,nosuid,noexec).
|
|
|
be81ba |
|
|
|
be81ba |
Addresses: https://github.com/karelzak/util-linux/issues/637
|
|
|
be81ba |
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1919529
|
|
|
be81ba |
Upstream: http://github.com/karelzak/util-linux/commit/e82b77e9696a6dada96a7f3ea3ec20a63e8e7b9e
|
|
|
be81ba |
Signed-off-by: Karel Zak <kzak@redhat.com>
|
|
|
be81ba |
---
|
|
|
be81ba |
libmount/src/context_mount.c | 22 ++++++++--------------
|
|
|
be81ba |
libmount/src/mountP.h | 3 +++
|
|
|
be81ba |
sys-utils/mount.8 | 5 +++--
|
|
|
be81ba |
3 files changed, 14 insertions(+), 16 deletions(-)
|
|
|
be81ba |
|
|
|
be81ba |
diff --git a/libmount/src/context_mount.c b/libmount/src/context_mount.c
|
|
|
be81ba |
index a6de36178..b88e60507 100644
|
|
|
be81ba |
--- a/libmount/src/context_mount.c
|
|
|
be81ba |
+++ b/libmount/src/context_mount.c
|
|
|
be81ba |
@@ -107,22 +107,16 @@ static int init_propagation(struct libmnt_context *cxt)
|
|
|
be81ba |
}
|
|
|
be81ba |
|
|
|
be81ba |
/*
|
|
|
be81ba |
- * add additional mount(2) syscall request to implement "ro,bind", the first regular
|
|
|
be81ba |
- * mount(2) is the "bind" operation, the second is "remount,ro,bind" call.
|
|
|
be81ba |
- *
|
|
|
be81ba |
- * Note that we don't remove "ro" from the first syscall (kernel silently
|
|
|
be81ba |
- * ignores this flags for bind operation) -- maybe one day kernel will support
|
|
|
be81ba |
- * read-only binds in one step and then all will be done by the first mount(2) and the
|
|
|
be81ba |
- * second remount will be noop...
|
|
|
be81ba |
+ * add additional mount(2) syscall request to implement "bind,<flags>", the first regular
|
|
|
be81ba |
+ * mount(2) is the "bind" operation, the second is "remount,bind,<flags>" call.
|
|
|
be81ba |
*/
|
|
|
be81ba |
-static int init_robind(struct libmnt_context *cxt)
|
|
|
be81ba |
+static int init_bind_remount(struct libmnt_context *cxt)
|
|
|
be81ba |
{
|
|
|
be81ba |
struct libmnt_addmount *ad;
|
|
|
be81ba |
int rc;
|
|
|
be81ba |
|
|
|
be81ba |
assert(cxt);
|
|
|
be81ba |
assert(cxt->mountflags & MS_BIND);
|
|
|
be81ba |
- assert(cxt->mountflags & MS_RDONLY);
|
|
|
be81ba |
assert(!(cxt->mountflags & MS_REMOUNT));
|
|
|
be81ba |
|
|
|
be81ba |
DBG(CXT, ul_debugobj(cxt, "mount: initialize additional ro,bind mount"));
|
|
|
be81ba |
@@ -131,9 +125,9 @@ static int init_robind(struct libmnt_context *cxt)
|
|
|
be81ba |
if (!ad)
|
|
|
be81ba |
return -ENOMEM;
|
|
|
be81ba |
|
|
|
be81ba |
- ad->mountflags = MS_REMOUNT | MS_BIND | MS_RDONLY;
|
|
|
be81ba |
- if (cxt->mountflags & MS_REC)
|
|
|
be81ba |
- ad->mountflags |= MS_REC;
|
|
|
be81ba |
+ ad->mountflags = cxt->mountflags;
|
|
|
be81ba |
+ ad->mountflags |= (MS_REMOUNT | MS_BIND);
|
|
|
be81ba |
+
|
|
|
be81ba |
rc = mnt_context_append_additional_mount(cxt, ad);
|
|
|
be81ba |
if (rc)
|
|
|
be81ba |
return rc;
|
|
|
be81ba |
@@ -254,9 +248,9 @@ static int fix_optstr(struct libmnt_context *cxt)
|
|
|
be81ba |
return rc;
|
|
|
be81ba |
}
|
|
|
be81ba |
if ((cxt->mountflags & MS_BIND)
|
|
|
be81ba |
- && (cxt->mountflags & MS_RDONLY)
|
|
|
be81ba |
+ && (cxt->mountflags & MNT_BIND_SETTABLE)
|
|
|
be81ba |
&& !(cxt->mountflags & MS_REMOUNT)) {
|
|
|
be81ba |
- rc = init_robind(cxt);
|
|
|
be81ba |
+ rc = init_bind_remount(cxt);
|
|
|
be81ba |
if (rc)
|
|
|
be81ba |
return rc;
|
|
|
be81ba |
}
|
|
|
be81ba |
diff --git a/libmount/src/mountP.h b/libmount/src/mountP.h
|
|
|
be81ba |
index 52a238ef3..64a507e61 100644
|
|
|
be81ba |
--- a/libmount/src/mountP.h
|
|
|
be81ba |
+++ b/libmount/src/mountP.h
|
|
|
be81ba |
@@ -363,6 +363,9 @@ struct libmnt_context
|
|
|
be81ba |
/* default flags */
|
|
|
be81ba |
#define MNT_FL_DEFAULT 0
|
|
|
be81ba |
|
|
|
be81ba |
+/* Flags usable with MS_BIND|MS_REMOUNT */
|
|
|
be81ba |
+#define MNT_BIND_SETTABLE (MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_NOATIME|MS_NODIRATIME|MS_RELATIME|MS_RDONLY)
|
|
|
be81ba |
+
|
|
|
be81ba |
/* lock.c */
|
|
|
be81ba |
extern int mnt_lock_use_simplelock(struct libmnt_lock *ml, int enable);
|
|
|
be81ba |
|
|
|
be81ba |
diff --git a/sys-utils/mount.8 b/sys-utils/mount.8
|
|
|
be81ba |
index a4d7de2c0..291e65cb1 100644
|
|
|
be81ba |
--- a/sys-utils/mount.8
|
|
|
be81ba |
+++ b/sys-utils/mount.8
|
|
|
be81ba |
@@ -410,8 +410,9 @@ will be writable, but the
|
|
|
be81ba |
will be read-only.
|
|
|
be81ba |
|
|
|
be81ba |
It's also possible to change nosuid, nodev, noexec, noatime, nodiratime and
|
|
|
be81ba |
-relatime VFS entry flags by "remount,bind" operation. It's impossible to change
|
|
|
be81ba |
-mount options recursively (for example with \fB-o rbind,ro\fR).
|
|
|
be81ba |
+relatime VFS entry flags by "remount,bind" operation. The another (for example
|
|
|
be81ba |
+filesystem specific flags) are silently ignored. It's impossible to change mount
|
|
|
be81ba |
+options recursively (for example with \fB-o rbind,ro\fR).
|
|
|
be81ba |
|
|
|
be81ba |
.BR mount (8)
|
|
|
be81ba |
since v2.31 ignores the \fBbind\fR flag from
|
|
|
be81ba |
--
|
|
|
be81ba |
2.31.1
|
|
|
be81ba |
|