opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-21 17:38:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

pkg/spec/initFSMounts: fix

Browse Source 
> $ ./bin/podman run -v /tmp:/tmp alpine true; echo $?
> 0
> $ ./bin/podman run -v /tmp:/tmp:ro alpine true; echo $?
> 0
> $ ./bin/podman run -v /tmp:/w0w:ro alpine true; echo $?
> Error: container_linux.go:349: starting container process caused "process_linux.go:449: container init caused \"rootfs_linux.go:58: mounting \\\"/tmp\\\" to rootfs \\\"/home/kir/.local/share/containers/storage/overlay/7636ef3650fc91ee4996ccc026532bb3cff7182c0430db662fffb933e0bcadc9/merged\\\" at \\\"/home/kir/.local/share/containers/storage/overlay/7636ef3650fc91ee4996ccc026532bb3cff7182c0430db662fffb933e0bcadc9/merged/w0w\\\" caused \\\"operation not permitted\\\"\"": OCI runtime permission denied error
> 126

The last command is not working because in-container mount point
is used to search for a parent mount in /proc/self/mountinfo.

And yet the following

> $ ./bin/podman run -v /tmp:/run/test:ro alpine true; echo $?
> 0

still works fine! Here's why:

> $ mount | grep -E '/run |/tmp '
> tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,mode=755)
> tmpfs on /tmp type tmpfs (rw,nosuid,nodev,seclabel)

This is the reason why previous commit modified in-container mount
point.

Fixes: 0f5ae3c5af
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2020-03-30 19:59:47 -07:00
parent 9c7410d331
commit c11c5e180a
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/spec/storage.go
View File

@ -867,9 +867,9 @@ func InitFSMounts(inputMounts []spec.Mount) ([]spec.Mount, error) {
var mounts []spec.Mount var mounts []spec.Mount
for _, m := range inputMounts { for _, m := range inputMounts {
if m.Type == TypeBind { if m.Type == TypeBind {
baseMnt, err := findMount(m.Destination, systemMounts) baseMnt, err := findMount(m.Source, systemMounts)
if err != nil { if err != nil {
return nil, errors.Wrapf(err, "error looking up mountpoint for mount %s", m.Destination) return nil, errors.Wrapf(err, "error looking up mountpoint for mount %s", m.Source)
} }
var noexec, nosuid, nodev bool var noexec, nosuid, nodev bool
for _, baseOpt := range strings.Split(baseMnt.Opts, ",") { for _, baseOpt := range strings.Split(baseMnt.Opts, ",") {