summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2020-09-02 07:49:11 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2020-09-02 08:00:22 -0400
commitd68a6b52ecd5354dccfb2f62dd7b06518200fa28 (patch)
tree4e2bbd2c71bf97bb6d75056c3f0606269f4c4771 /libpod
parent1184cdf03d8464451d36b24643e57b65a8b97980 (diff)
downloadpodman-d68a6b52ecd5354dccfb2f62dd7b06518200fa28.tar.gz
podman-d68a6b52ecd5354dccfb2f62dd7b06518200fa28.tar.bz2
podman-d68a6b52ecd5354dccfb2f62dd7b06518200fa28.zip
We should not be mounting /run as noexec when run with --systemd
The system defaults /run to "exec" mode, and we default --read-only mounts on /run to "exec", so --systemd should follow suit. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'libpod')
-rw-r--r--libpod/container_internal_linux.go4
1 files changed, 2 insertions, 2 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index c61c1a325..f789b0069 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -563,7 +563,7 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
// systemd expects to have /run, /run/lock and /tmp on tmpfs
// It also expects to be able to write to /sys/fs/cgroup/systemd and /var/log/journal
func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) error {
- options := []string{"rw", "rprivate", "noexec", "nosuid", "nodev"}
+ options := []string{"rw", "rprivate", "nosuid", "nodev"}
for _, dest := range []string{"/run", "/run/lock"} {
if MountExists(mounts, dest) {
continue
@@ -627,7 +627,7 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
Destination: "/sys/fs/cgroup/systemd",
Type: "bind",
Source: "/sys/fs/cgroup/systemd",
- Options: []string{"bind", "nodev", "noexec", "nosuid", "rprivate"},
+ Options: []string{"bind", "nodev", "nosuid", "rprivate"},
}
g.AddMount(systemdMnt)
g.AddLinuxMaskedPaths("/sys/fs/cgroup/systemd/release_agent")