[v4.9-rhel] Fix: Remove appending rw as the default mount option#28197
Conversation
|
LGTM. I wonder if we need to backport something more to fix the AWS build failure. I know it also happened on main branch and I've fixed it by rebasing to latest main in my PRs, so I think some commit in main fixed it? |
|
@timcoding1988 you need to backport your AWS changes to all active branches like I mentioned. If I look at our cron job these are the branches we need for sure Cron build 'v5.7' Failed: https://cirrus-ci.com/build/6672833683652608 Although I guess we don't need 5.7 but rather 5.8 now, I need to update the cron job setting |
|
@Luap99 sure ! all the backport pr for the active branch are out. |
The backstory for this is that runc 1.2 (opencontainers/runc#3967) fixed a long-standing bug in our mount flag handling (a bug that crun still has). Before runc 1.2, when dealing with locked mount flags that user namespaced containers cannot clear, trying to explicitly clearing locked flags (like rw clearing MS_RDONLY) would silently ignore the rw flag in most cases and would result in a read-only mount. This is obviously not what the user expects. What runc 1.2 did is that it made it so that passing clearing flags like rw would always result in an attempt to clear the flag (which was not the case before), and would (in all cases) explicitly return an error if we try to clear locking flags. (This also let us finally fix a bunch of other long-standing issues with locked mount flags causing seemingly spurious errors). The problem is that podman sets rw on all mounts by default (even if the user doesn't specify anything). This is actually a no-op in runc 1.1 and crun because of a bug in how clearing flags were handled (rw is the absence of MS_RDONLY but until runc 1.2 we didn't correctly track clearing flags like that, meaning that rw would literally be handled as if it were not set at all by users) but in runc 1.2 leads to unfortunate breakages and a subtle change in behaviour (before, a ro mount being bind-mounted into a container would also be ro -- though due to the above bug even setting rw explicitly would result in ro in most cases -- but with runc 1.2 the mount will always be rw even if the user didn't explicitly request it which most users would find surprising). By the way, this "always set rw" behaviour is a departure from Docker and it is not necesssary. Fixes: https://issues.redhat.com/browse/RHEL-152630, https://issues.redhat.com/browse/RHEL-153022 Signed-off-by: rcmadhankumar <madhankumar.chellamuthu@suse.com> (cherry picked from commit bf7dcd5) Signed-off-by: Tom Sweeney <tsweeney@redhat.com>
TomSweeneyRedHat
force-pushed
the
dev/tsweeney/accel-596-v4.9-rhel
branch
from
8ab1a23 to
f6b4d72
Compare
|
Rebased, hopefully that will pick up the AWS update |
5 participants
The backstory for this is that runc 1.2 (opencontainers/runc#3967) fixed a long-standing bug in our mount flag handling (a bug that crun still has). Before runc 1.2, when dealing with locked mount flags that user namespaced containers cannot clear, trying to explicitly clearing locked flags (like rw clearing MS_RDONLY) would silently ignore the rw flag in most cases and would result in a read-only mount. This is obviously not what the user expects.
What runc 1.2 did is that it made it so that passing clearing flags like rw would always result in an attempt to clear the flag (which was not the case before), and would (in all cases) explicitly return an error if we try to clear locking flags. (This also let us finally fix a bunch of other long-standing issues with locked mount flags causing seemingly spurious errors).
The problem is that podman sets rw on all mounts by default (even if the user doesn't specify anything). This is actually a no-op in runc 1.1 and crun because of a bug in how clearing flags were handled (rw is the absence of MS_RDONLY but until runc 1.2 we didn't correctly track clearing flags like that, meaning that rw would literally be handled as if it were not set at all by users) but in runc 1.2 leads to unfortunate breakages and a subtle change in behaviour (before, a ro mount being bind-mounted into a container would also be ro -- though due to the above bug even setting rw explicitly would result in ro in most cases -- but with runc 1.2 the mount will always be rw even if the user didn't explicitly request it which most users would find surprising). By the way, this "always set rw" behaviour is a departure from Docker and it is not necesssary.
Fixes: https://issues.redhat.com/browse/RHEL-152630, https://issues.redhat.com/browse/RHEL-153022
(cherry picked from commit bf7dcd5)
Checklist
Ensure you have completed the following checklist for your pull request to be reviewed:
commits. (
git commit -s). (If needed, usegit commit -s --amend). The author email must matchthe sign-off email address. See CONTRIBUTING.md
for more information.
Fixes: #00000in commit message (if applicable)make validatepr(format/lint checks)Noneif no user-facing changes)Does this PR introduce a user-facing change?