From 11c5b0237b799ad61b53d67817af673a3d286f25 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Mon, 5 Nov 2018 20:02:50 +0100 Subject: rootless: don't bind mount /sys/fs/cgroup/systemd in systemd mode it is not writeable by non-root users so there is no point in having access to it from a container. Signed-off-by: Giuseppe Scrivano --- libpod/container_internal_linux.go | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) (limited to 'libpod') diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index 7bf2c71ca..dc829ca55 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -360,19 +360,23 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro g.AddMount(tmpfsMnt) } - cgroupPath, err := c.CGroupPath() - if err != nil { - return err - } - sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath) + // rootless containers have no write access to /sys/fs/cgroup, so don't + // add any mount into the container. + if !rootless.IsRootless() { + cgroupPath, err := c.CGroupPath() + if err != nil { + return err + } + sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath) - systemdMnt := spec.Mount{ - Destination: "/sys/fs/cgroup/systemd", - Type: "bind", - Source: sourcePath, - Options: []string{"bind", "private"}, + systemdMnt := spec.Mount{ + Destination: "/sys/fs/cgroup/systemd", + Type: "bind", + Source: sourcePath, + Options: []string{"bind", "private"}, + } + g.AddMount(systemdMnt) } - g.AddMount(systemdMnt) return nil } -- cgit v1.2.3-54-g00ecf