From c11c5e180a6e00e0093f51b050962ee1e2e30f7a Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 30 Mar 2020 19:59:47 -0700 Subject: pkg/spec/initFSMounts: fix > $ ./bin/podman run -v /tmp:/tmp alpine true; echo $? > 0 > $ ./bin/podman run -v /tmp:/tmp:ro alpine true; echo $? > 0 > $ ./bin/podman run -v /tmp:/w0w:ro alpine true; echo $? > Error: container_linux.go:349: starting container process caused "process_linux.go:449: container init caused \"rootfs_linux.go:58: mounting \\\"/tmp\\\" to rootfs \\\"/home/kir/.local/share/containers/storage/overlay/7636ef3650fc91ee4996ccc026532bb3cff7182c0430db662fffb933e0bcadc9/merged\\\" at \\\"/home/kir/.local/share/containers/storage/overlay/7636ef3650fc91ee4996ccc026532bb3cff7182c0430db662fffb933e0bcadc9/merged/w0w\\\" caused \\\"operation not permitted\\\"\"": OCI runtime permission denied error > 126 The last command is not working because in-container mount point is used to search for a parent mount in /proc/self/mountinfo. And yet the following > $ ./bin/podman run -v /tmp:/run/test:ro alpine true; echo $? > 0 still works fine! Here's why: > $ mount | grep -E '/run |/tmp ' > tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,mode=755) > tmpfs on /tmp type tmpfs (rw,nosuid,nodev,seclabel) This is the reason why previous commit modified in-container mount point. Fixes: 0f5ae3c5af Signed-off-by: Kir Kolyshkin --- pkg/spec/storage.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/spec/storage.go b/pkg/spec/storage.go index b0687b4c2..404d94432 100644 --- a/pkg/spec/storage.go +++ b/pkg/spec/storage.go @@ -867,9 +867,9 @@ func InitFSMounts(inputMounts []spec.Mount) ([]spec.Mount, error) { var mounts []spec.Mount for _, m := range inputMounts { if m.Type == TypeBind { - baseMnt, err := findMount(m.Destination, systemMounts) + baseMnt, err := findMount(m.Source, systemMounts) if err != nil { - return nil, errors.Wrapf(err, "error looking up mountpoint for mount %s", m.Destination) + return nil, errors.Wrapf(err, "error looking up mountpoint for mount %s", m.Source) } var noexec, nosuid, nodev bool for _, baseOpt := range strings.Split(baseMnt.Opts, ",") { -- cgit v1.2.3-54-g00ecf