diff options
Diffstat (limited to 'morphlib/extensions.py')
-rw-r--r-- | morphlib/extensions.py | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/morphlib/extensions.py b/morphlib/extensions.py index af6ba279..6b81e116 100644 --- a/morphlib/extensions.py +++ b/morphlib/extensions.py @@ -223,7 +223,11 @@ class ExtensionSubprocess(object): def close_read_end(): os.close(log_read_fd) p = subprocess.Popen( - [filename] + args, cwd=cwd, env=new_env, + # We unshare and mount --make-rprivate so mounts done by write + # extensions can't interfere with the rest of the system. + ['unshare', '-m', '--', '/bin/sh', '-c', + 'mount --make-rprivate / && exec "$@"', '-', filename] + args, + cwd=cwd, env=new_env, stdout=subprocess.PIPE, stderr=subprocess.PIPE, preexec_fn=close_read_end) os.close(log_write_fd) |