diff options
| author | Andy Librian <andylibrian@gmail.com> | 2020-10-24 15:50:33 +0700 |
|---|---|---|
| committer | Andy Librian <andylibrian@gmail.com> | 2020-10-30 20:51:34 +0700 |
| commit | 6779c1cfc203a545d0b17d7a413b0f7daa6b1e43 (patch) | |
| tree | 64a9fcdcefb376ab83f9f8e2a9941bd1e2a8fb61 /libpod | |
| parent | 228396a99dc88fc828f23d4072a46ca8de90282f (diff) | |
| download | podman-6779c1cfc203a545d0b17d7a413b0f7daa6b1e43.tar.gz podman-6779c1cfc203a545d0b17d7a413b0f7daa6b1e43.tar.bz2 podman-6779c1cfc203a545d0b17d7a413b0f7daa6b1e43.zip | |
Improve setupSystemd, grab mount options from the host
fixes #7661
Signed-off-by: Andy Librian <andylibrian@gmail.com>
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/container_internal_linux.go | 22 |
1 files changed, 21 insertions, 1 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index 57d5100cf..043924166 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -698,11 +698,31 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro } g.AddMount(systemdMnt) } else { + mountOptions := []string{"bind", "rprivate"} + + var statfs unix.Statfs_t + if err := unix.Statfs("/sys/fs/cgroup/systemd", &statfs); err != nil { + mountOptions = append(mountOptions, "nodev", "noexec", "nosuid") + } else { + if statfs.Flags&unix.MS_NODEV == unix.MS_NODEV { + mountOptions = append(mountOptions, "nodev") + } + if statfs.Flags&unix.MS_NOEXEC == unix.MS_NOEXEC { + mountOptions = append(mountOptions, "noexec") + } + if statfs.Flags&unix.MS_NOSUID == unix.MS_NOSUID { + mountOptions = append(mountOptions, "nosuid") + } + if statfs.Flags&unix.MS_RDONLY == unix.MS_RDONLY { + mountOptions = append(mountOptions, "ro") + } + } + systemdMnt := spec.Mount{ Destination: "/sys/fs/cgroup/systemd", Type: "bind", Source: "/sys/fs/cgroup/systemd", - Options: []string{"bind", "nodev", "noexec", "nosuid", "rprivate"}, + Options: mountOptions, } g.AddMount(systemdMnt) g.AddLinuxMaskedPaths("/sys/fs/cgroup/systemd/release_agent") |