diff options
author | Luca Boccassi <luca.boccassi@microsoft.com> | 2020-07-16 09:47:16 +0100 |
---|---|---|
committer | Luca Boccassi <luca.boccassi@microsoft.com> | 2020-07-16 09:59:59 +0100 |
commit | 14f1c47a0cd0c9ad9c30e2354a0fdba26417ccf0 (patch) | |
tree | a4e752f18e185e73d8dcf2be1032feb79cd271ff | |
parent | eafc7d60569064f30663a93463b7c5df5768bac6 (diff) | |
download | systemd-14f1c47a0cd0c9ad9c30e2354a0fdba26417ccf0.tar.gz |
nspawn: mount os-release in two steps to make it read-only
The kernel interface requires setting up read-only bind-mounts in
two steps, the bind first and then a read-only remount.
Fix nspawn-mount, and cover this case in the integration test.
Fixes #16484
-rw-r--r-- | src/nspawn/nspawn-mount.c | 10 | ||||
-rwxr-xr-x | test/units/testsuite-13.sh | 2 |
2 files changed, 9 insertions, 3 deletions
diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index ea250af0d7..4687ac4c18 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -563,10 +563,14 @@ int mount_all(const char *dest, MOUNT_FATAL|MOUNT_MKDIR }, { "tmpfs", "/run", "tmpfs", "mode=755" TMPFS_LIMITS_RUN, MS_NOSUID|MS_NODEV|MS_STRICTATIME, MOUNT_FATAL|MOUNT_MKDIR }, - { "/usr/lib/os-release", "/run/host/usr/lib/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, - MOUNT_FATAL|MOUNT_MKDIR|MOUNT_TOUCH }, - { "/etc/os-release", "/run/host/etc/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV, + { "/usr/lib/os-release", "/run/host/usr/lib/os-release", NULL, NULL, MS_BIND, + MOUNT_FATAL|MOUNT_MKDIR|MOUNT_TOUCH }, /* As per kernel interface requirements, bind mount first (creating mount points) and make read-only later */ + { NULL, "/run/host/usr/lib/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, + 0 }, + { "/etc/os-release", "/run/host/etc/os-release", NULL, NULL, MS_BIND, MOUNT_MKDIR|MOUNT_TOUCH }, + { NULL, "/run/host/etc/os-release", NULL, NULL, MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, + 0 }, #if HAVE_SELINUX { "/sys/fs/selinux", "/sys/fs/selinux", NULL, NULL, MS_BIND, diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh index dd1c9575c4..0ad75ac8b0 100755 --- a/test/units/testsuite-13.sh +++ b/test/units/testsuite-13.sh @@ -67,6 +67,8 @@ if [ -n "${VERSION_ID:+set}" ] && [ "${VERSION_ID}" != "${container_host_version if [ -n "${BUILD_ID:+set}" ] && [ "${BUILD_ID}" != "${container_host_build_id}" ]; then exit 1; fi if [ -n "${VARIANT_ID:+set}" ] && [ "${VARIANT_ID}" != "${container_host_variant_id}" ]; then exit 1; fi cd /tmp; (cd /run/host/usr/lib; md5sum os-release) | md5sum -c +if echo test >> /run/host/usr/lib/os-release; then exit 1; fi +if echo test >> /run/host/etc/os-release; then exit 1; fi ' systemd-nspawn --register=no -D /testsuite-13.nc-container --bind=/etc/os-release:/tmp/os-release /bin/sh -x -e -c "$_cmd" |