|
 |
24a685 |
From 62b0c31d4b940ff93a23ac6fdb3a6ef345910abf Mon Sep 17 00:00:00 2001
|
|
|
24a685 |
From: Kir Kolyshkin <kolyshkin@gmail.com>
|
|
|
24a685 |
Date: Tue, 14 Jun 2022 17:19:10 -0700
|
|
|
24a685 |
Subject: [PATCH] libct: fix mounting via wrong proc fd
|
|
|
24a685 |
|
|
|
24a685 |
Due to a bug in commit 9c444070ec7, when the user and mount namespaces
|
|
|
24a685 |
are used, and the bind mount is followed by the cgroup mount in the
|
|
|
24a685 |
spec, the cgroup is mounted using the bind mount's mount fd.
|
|
|
24a685 |
|
|
|
24a685 |
This can be reproduced with podman 4.1 (when configured to use runc):
|
|
|
24a685 |
|
|
|
24a685 |
$ podman run --uidmap 0:100:10000 quay.io/libpod/testimage:20210610 mount
|
|
|
24a685 |
Error: /home/kir/git/runc/runc: runc create failed: unable to start container process: error during container init: error mounting "cgroup" to rootfs at "/sys/fs/cgroup": mount /proc/self/fd/11:/sys/fs/cgroup/systemd (via /proc/self/fd/12), flags: 0x20502f: operation not permitted: OCI permission denied
|
|
|
24a685 |
|
|
|
24a685 |
or manually with the spec mounts containing something like this:
|
|
|
24a685 |
|
|
|
24a685 |
{
|
|
|
24a685 |
"destination": "/etc/resolv.conf",
|
|
|
24a685 |
"type": "bind",
|
|
|
24a685 |
"source": "/userdata/resolv.conf",
|
|
|
24a685 |
"options": [
|
|
|
24a685 |
"bind"
|
|
|
24a685 |
]
|
|
|
24a685 |
},
|
|
|
24a685 |
{
|
|
|
24a685 |
"destination": "/sys/fs/cgroup",
|
|
|
24a685 |
"type": "cgroup",
|
|
|
24a685 |
"source": "cgroup",
|
|
|
24a685 |
"options": [
|
|
|
24a685 |
"rprivate",
|
|
|
24a685 |
"nosuid",
|
|
|
24a685 |
"noexec",
|
|
|
24a685 |
"nodev",
|
|
|
24a685 |
"relatime",
|
|
|
24a685 |
"ro"
|
|
|
24a685 |
]
|
|
|
24a685 |
}
|
|
|
24a685 |
|
|
|
24a685 |
The issue was not found earlier since it requires using userns, and even then
|
|
|
24a685 |
mount fd is ignored by mountToRootfs, except for bind mounts, and all the bind
|
|
|
24a685 |
mounts have mountfd set, except for the case of cgroup v1's /sys/fs/cgroup
|
|
|
24a685 |
which is internally transformed into a bunch of bind mounts.
|
|
|
24a685 |
|
|
|
24a685 |
This is a minimal fix for the issue, suitable for backporting.
|
|
|
24a685 |
|
|
|
24a685 |
Fixes: 9c444070ec7 ("Open bind mount sources from the host userns")
|
|
|
24a685 |
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
|
|
|
24a685 |
(cherry picked from commit b3aa20af7fb67ee1f2b381f3c82329e73c7d3a0c)
|
|
|
24a685 |
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
|
|
|
24a685 |
---
|
|
|
24a685 |
libcontainer/rootfs_linux.go | 2 ++
|
|
|
24a685 |
1 file changed, 2 insertions(+)
|
|
|
24a685 |
|
|
|
24a685 |
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
|
|
|
24a685 |
index 3cfd2bf1e4..ec7638e4d5 100644
|
|
|
24a685 |
--- a/libcontainer/rootfs_linux.go
|
|
|
24a685 |
+++ b/libcontainer/rootfs_linux.go
|
|
|
24a685 |
@@ -80,6 +80,8 @@ func prepareRootfs(pipe io.ReadWriter, iConfig *initConfig, mountFds []int) (err
|
|
|
24a685 |
// Therefore, we can access mountFds[i] without any concerns.
|
|
|
24a685 |
if mountFds != nil && mountFds[i] != -1 {
|
|
|
24a685 |
mountConfig.fd = &mountFds[i]
|
|
|
24a685 |
+ } else {
|
|
|
24a685 |
+ mountConfig.fd = nil
|
|
|
24a685 |
}
|
|
|
24a685 |
|
|
|
24a685 |
if err := mountToRootfs(m, mountConfig); err != nil {
|