opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-29 23:22:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

Swap default mount propagation from private to rprivate

Browse Source 
This matches Docker behavior more closely and should resolve an
issue we were seeing with /sys mounts

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

Closes: #1465
Approved by: rhatdan
This commit is contained in:
Matthew Heon
2018-09-13 15:00:58 -04:00
committed by Atomic Bot
parent f0a3a4329e
commit e2137cd009
4 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/secrets/secrets.go
View File

@ -243,7 +243,7 @@ func addSecretsFromMountsFile(filePath, mountLabel, containerWorkingDir, mountPr
Source: filepath.Join(mountPrefix, ctrDir), Source: filepath.Join(mountPrefix, ctrDir),
Destination: ctrDir, Destination: ctrDir,
Type: "bind", Type: "bind",
Options: []string{"bind", "private"}, Options: []string{"bind", "rprivate"},
} }
mounts = append(mounts, m) mounts = append(mounts, m)
@ -278,7 +278,7 @@ func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir string) error
Source: ctrDirOnHost, Source: ctrDirOnHost,
Destination: secretsDir, Destination: secretsDir,
Type: "bind", Type: "bind",
Options: []string{"bind", "private"}, Options: []string{"bind", "rprivate"},
} }
*mounts = append(*mounts, m) *mounts = append(*mounts, m)
} }

6
pkg/spec/createconfig.go
View File

@ -189,7 +189,7 @@ func (c *CreateConfig) GetVolumeMounts(specMounts []spec.Mount) ([]spec.Mount, e
} }
} }
if rootProp == "" { if rootProp == "" {
options = append(options, "private") options = append(options, "rprivate")
} }
m = append(m, spec.Mount{ m = append(m, spec.Mount{
@ -214,7 +214,7 @@ func (c *CreateConfig) GetVolumeMounts(specMounts []spec.Mount) ([]spec.Mount, e
Destination: vol, Destination: vol,
Type: string(TypeTmpfs), Type: string(TypeTmpfs),
Source: string(TypeTmpfs), Source: string(TypeTmpfs),
Options: []string{"private", "rw", "noexec", "nosuid", "nodev", "tmpcopyup"}, Options: []string{"rprivate", "rw", "noexec", "nosuid", "nodev", "tmpcopyup"},
} }
m = append(m, mount) m = append(m, mount)
} }
@ -272,7 +272,7 @@ func (c *CreateConfig) GetTmpfsMounts() []spec.Mount {
var m []spec.Mount var m []spec.Mount
for _, i := range c.Tmpfs { for _, i := range c.Tmpfs {
// Default options if nothing passed // Default options if nothing passed
options := []string{"private", "rw", "noexec", "nosuid", "nodev", "size=65536k"} options := []string{"rprivate", "rw", "noexec", "nosuid", "nodev", "size=65536k"}
spliti := strings.Split(i, ":") spliti := strings.Split(i, ":")
destPath := spliti[0] destPath := spliti[0]
if len(spliti) > 1 { if len(spliti) > 1 {

12
pkg/spec/spec.go
View File

@ -43,7 +43,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Destination: "/sys", Destination: "/sys",
Type: "sysfs", Type: "sysfs",
Source: "sysfs", Source: "sysfs",
Options: []string{"private", "nosuid", "noexec", "nodev", "rw"}, Options: []string{"rprivate", "nosuid", "noexec", "nodev", "rw"},
} }
g.AddMount(sysMnt) g.AddMount(sysMnt)
} else if !canMountSys { } else if !canMountSys {
@ -57,7 +57,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Destination: "/sys", Destination: "/sys",
Type: "bind", Type: "bind",
Source: "/sys", Source: "/sys",
Options: []string{"nosuid", "noexec", "nodev", r, "rbind"}, Options: []string{"rprivate", "nosuid", "noexec", "nodev", r, "rbind"},
} }
g.AddMount(sysMnt) g.AddMount(sysMnt)
} }
@ -67,7 +67,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Destination: "/dev/pts", Destination: "/dev/pts",
Type: "devpts", Type: "devpts",
Source: "devpts", Source: "devpts",
Options: []string{"private", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"}, Options: []string{"rprivate", "nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620"},
} }
g.AddMount(devPts) g.AddMount(devPts)
} }
@ -97,7 +97,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
Destination: "/sys/fs/cgroup", Destination: "/sys/fs/cgroup",
Type: "cgroup", Type: "cgroup",
Source: "cgroup", Source: "cgroup",
Options: []string{"private", "nosuid", "noexec", "nodev", "relatime", cgroupPerm}, Options: []string{"rprivate", "nosuid", "noexec", "nodev", "relatime", cgroupPerm},
} }
g.AddMount(cgroupMnt) g.AddMount(cgroupMnt)
} }
@ -231,7 +231,7 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
} }
for _, i := range config.Tmpfs { for _, i := range config.Tmpfs {
// Default options if nothing passed // Default options if nothing passed
options := []string{"rw", "private", "noexec", "nosuid", "nodev", "size=65536k"} options := []string{"rw", "rprivate", "noexec", "nosuid", "nodev", "size=65536k"}
spliti := strings.SplitN(i, ":", 2) spliti := strings.SplitN(i, ":", 2)
if len(spliti) > 1 { if len(spliti) > 1 {
if _, _, err := mount.ParseTmpfsOptions(spliti[1]); err != nil { if _, _, err := mount.ParseTmpfsOptions(spliti[1]); err != nil {
@ -385,7 +385,7 @@ func setupSystemd(config *CreateConfig, g *generate.Generator) error {
if err != nil { if err != nil {
return err return err
} }
options := []string{"rw", "private", "noexec", "nosuid", "nodev"} options := []string{"rw", "rprivate", "noexec", "nosuid", "nodev"}
for _, dest := range []string{"/run", "/run/lock", "/sys/fs/cgroup/systemd"} { for _, dest := range []string{"/run", "/run/lock", "/sys/fs/cgroup/systemd"} {
if libpod.MountExists(mounts, dest) { if libpod.MountExists(mounts, dest) {
continue continue

2
pkg/spec/spec_test.go
View File

@ -13,7 +13,7 @@ func TestCreateConfig_GetVolumeMounts(t *testing.T) {
Destination: "/foobar", Destination: "/foobar",
Type: "bind", Type: "bind",
Source: "foobar", Source: "foobar",
Options: []string{"ro", "rbind", "private"}, Options: []string{"ro", "rbind", "rprivate"},
} }
config := CreateConfig{ config := CreateConfig{
Volumes: []string{"foobar:/foobar:ro"}, Volumes: []string{"foobar:/foobar:ro"},