diff options
Diffstat (limited to 'src/nspawn')
| -rw-r--r-- | src/nspawn/nspawn.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index db9e3b12c7..13d744870d 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -3758,6 +3758,19 @@ static int outer_child( directory = "/run/systemd/nspawn-root"; } + /* Make sure we always have a mount that we can move to root later on. */ + r = make_mount_point(directory); + if (r < 0) + return r; + + /* So the whole tree is now MS_SLAVE, i.e. we'll still receive mount/umount events from the host + * mount namespace. For the directory we are going to run our container let's turn this off, so that + * we'll live in our own little world from now on, and propagation from the host may only happen via + * the mount tunnel dir, or not at all. */ + r = mount_follow_verbose(LOG_ERR, NULL, directory, NULL, MS_PRIVATE|MS_REC, NULL); + if (r < 0) + return r; + r = setup_pivot_root( directory, arg_pivot_root_new, @@ -3815,11 +3828,6 @@ static int outer_child( if (r < 0) return r; - /* Make sure we always have a mount that we can move to root later on. */ - r = make_mount_point(directory); - if (r < 0) - return r; - if (arg_userns_mode != USER_NAMESPACE_NO && IN_SET(arg_userns_ownership, USER_NAMESPACE_OWNERSHIP_MAP, USER_NAMESPACE_OWNERSHIP_AUTO) && arg_uid_shift != 0) { |