| From 36b51f3b1f6129a29abdee018d5d63f6ae37b586 Mon Sep 17 00:00:00 2001 |
| Message-Id: <36b51f3b1f6129a29abdee018d5d63f6ae37b586.1380112456.git.jdenemar@redhat.com> |
| From: Gao feng <gaofeng@cn.fujitsu.com> |
| Date: Fri, 20 Sep 2013 13:07:48 +0100 |
| Subject: [PATCH] LXC: Don't mount securityfs when user namespace enabled |
| |
| For |
| |
| https://bugzilla.redhat.com/show_bug.cgi?id=872648 |
| |
| Right now, securityfs is disallowed to be mounted in non-initial |
| user namespace, so we must avoid trying to mount securityfs in |
| a container which has user namespace enabled. |
| |
| Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> |
| (cherry picked from commit 1583dfda7c4e5ad71efe0615c06e5676528d8203) |
| Signed-off-by: Jiri Denemark <jdenemar@redhat.com> |
| |
| src/lxc/lxc_container.c | 7 +++++-- |
| 1 file changed, 5 insertions(+), 2 deletions(-) |
| |
| diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c |
| index 8abaea0..c41ab40 100644 |
| |
| |
| @@ -750,7 +750,7 @@ err: |
| } |
| |
| |
| -static int lxcContainerMountBasicFS(void) |
| +static int lxcContainerMountBasicFS(bool userns_enabled) |
| { |
| const struct { |
| const char *src; |
| @@ -801,6 +801,9 @@ static int lxcContainerMountBasicFS(void) |
| continue; |
| #endif |
| |
| + if (STREQ(mnts[i].src, "securityfs") && userns_enabled) |
| + continue; |
| + |
| if (virFileMakePath(mnts[i].dst) < 0) { |
| virReportSystemError(errno, |
| _("Failed to mkdir %s"), |
| @@ -1530,7 +1533,7 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef, |
| goto cleanup; |
| |
| /* Mounts the core /proc, /sys, etc filesystems */ |
| - if (lxcContainerMountBasicFS() < 0) |
| + if (lxcContainerMountBasicFS(vmDef->idmap.nuidmap) < 0) |
| goto cleanup; |
| |
| /* Mounts /proc/meminfo etc sysinfo */ |
| -- |
| 1.8.3.2 |
| |