Skip to content

Fix mount error when chmod RO tmpfs#2570

Merged
AkihiroSuda merged 1 commit intoopencontainers:masterfrom
EduardoVega:2246-fix-chmod-ro-tmpfs-mount
Oct 26, 2020
Merged

Fix mount error when chmod RO tmpfs#2570
AkihiroSuda merged 1 commit intoopencontainers:masterfrom
EduardoVega:2246-fix-chmod-ro-tmpfs-mount

Conversation

@EduardoVega
Copy link
Copy Markdown
Contributor

@EduardoVega EduardoVega commented Aug 28, 2020 •
edited
Loading

Based on the comments, this will mount the filesystem rw, then chmod, and finally remount it with ro.

Fixes #2246

Signed-off-by: Eduardo Vega edvegavalerio@gmail.com

@EduardoVega EduardoVega force-pushed the 2246-fix-chmod-ro-tmpfs-mount branch from e9412d9 to c8e2cfa Compare August 28, 2020 22:42
AkihiroSuda
AkihiroSuda reviewed Aug 28, 2020
View reviewed changes
Comment thread libcontainer/rootfs_linux.go Outdated
AkihiroSuda
AkihiroSuda previously approved these changes Aug 29, 2020
View reviewed changes
@EduardoVega EduardoVega force-pushed the 2246-fix-chmod-ro-tmpfs-mount branch from 577caf0 to 2734c76 Compare September 9, 2020 23:00
@EduardoVega
Copy link
Copy Markdown
Contributor Author

EduardoVega commented Sep 10, 2020

@AkihiroSuda I have squashed the commits, they were not initially.

AkihiroSuda
AkihiroSuda previously approved these changes Sep 10, 2020
View reviewed changes
@AkihiroSuda
Copy link
Copy Markdown
Member

AkihiroSuda commented Sep 17, 2020

@kolyshkin PTAL

kolyshkin
kolyshkin reviewed Oct 1, 2020
View reviewed changes
Comment thread libcontainer/rootfs_linux.go Outdated
kolyshkin
kolyshkin reviewed Oct 1, 2020
View reviewed changes
Comment thread libcontainer/rootfs_linux.go Outdated
kolyshkin
kolyshkin reviewed Oct 1, 2020
View reviewed changes
Comment thread tests/integration/mounts.bats Outdated
kolyshkin
kolyshkin reviewed Oct 1, 2020
View reviewed changes
Comment thread tests/integration/mounts.bats Outdated
kolyshkin
kolyshkin reviewed Oct 1, 2020
View reviewed changes
Comment thread libcontainer/rootfs_linux.go
kolyshkin
kolyshkin reviewed Oct 1, 2020
View reviewed changes
Comment thread libcontainer/rootfs_linux.go
kolyshkin
kolyshkin requested changes Oct 1, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@kolyshkin kolyshkin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

left some suggestions

@EduardoVega
Fix mount error when chmod RO tmpfs
fb4c27c 
Signed-off-by: Eduardo Vega <edvegavalerio@gmail.com>
@EduardoVega EduardoVega force-pushed the 2246-fix-chmod-ro-tmpfs-mount branch from 2734c76 to fb4c27c Compare October 6, 2020 03:24
@EduardoVega
Copy link
Copy Markdown
Contributor Author

EduardoVega commented Oct 6, 2020

Thanks. I have completed all requested changes.

kolyshkin
kolyshkin approved these changes Oct 6, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@kolyshkin kolyshkin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kolyshkin
Copy link
Copy Markdown
Contributor

kolyshkin commented Oct 8, 2020

@AkihiroSuda @mrunalp PTAL

@AkihiroSuda AkihiroSuda merged commit 9d4c02c into opencontainers:master Oct 26, 2020
@mauriciovasquezbernal mauriciovasquezbernal mentioned this pull request Oct 29, 2020
Closed
@kolyshkin kolyshkin mentioned this pull request Oct 29, 2020
Merged
This was referenced Nov 12, 2021
Merged
Merged
@rpluem-vf rpluem-vf mentioned this pull request Jan 25, 2023
Closed
@rpluem-vf rpluem-vf mentioned this pull request Apr 3, 2023
Merged
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Apr 3, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
4f72891 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with roset. Follow the same approach for nodev, nosuid, noexec .

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Apr 3, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
39772f8 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with roset. Follow the same approach for nodev, nosuid, noexec .

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Apr 4, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
c77fa13 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with roset. Follow the same approach for nodev, nosuid, noexec .

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Apr 5, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
a1b4b71 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set. Follow the same approach for nodev, nosuid, noexec.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Apr 18, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
ced74a5 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set. Follow the same approach for nodev, nosuid, noexec.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Apr 24, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
4d70297 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set. Follow the same approach for nodev, nosuid, noexec.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Apr 25, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
8ed05fc 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set. Follow the same approach for nodev, nosuid, noexec.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Apr 26, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
0a34343 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set. Follow the same approach for nodev, nosuid, noexec.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request May 9, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
30ebbe0 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set. Follow the same approach for nodev, nosuid, noexec.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Jun 2, 2023
@rpluem-vf
Fix bind mounts of filesystems with nodev, nosuid, noexec options set
9c7b64f 
Currently bind mounts of filesystems with nodev, nosuid, noexec options
set fail in rootless mode if the same options are not set for the bind
mount. For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set. Follow the same approach for nodev, nosuid, noexec.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Jun 12, 2023
@rpluem-vf
Fix bind mounts of filesystems with certain options set
8cb4ca7 
Currently bind mounts of filesystems with nodev, nosuid, noexec,
noatime, relatime, strictatime, nodiratime options set fail in rootless
mode if the same options are not set for the bind mount.
For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set.

Follow the same approach for nodev, nosuid, noexec, noatime, relatime,
strictatime, nodiratime but allow to revert back to the old behaviour
via the new `--no-mount-fallback` command line option.

Add a testcase to verify that bind mounts of filesystems with nodev,
nosuid, noexec, noatime options set work in rootless mode.
Add a testcase that mounts a nodev, nosuid, noexec, noatime filesystem
with a ro flag.
Add two further testcases that ensure that the above testcases would
fail if the `--no-mount-fallback` command line option is set.

* contrib/completions/bash/runc:
      Add `--no-mount-fallback` command line option for bash completion.

* create.go:
      Add `--no-mount-fallback` command line option.

* restore.go:
      Add `--no-mount-fallback` command line option.

* run.go:
      Add `--no-mount-fallback` command line option.

* libcontainer/configs/config.go:
      Add `NoMountFallback` field to the `Config` struct to store
      the command line option value.

* libcontainer/specconv/spec_linux.go:
      Add `NoMountFallback` field to the `CreateOpts` struct to store
      the command line option value and store it in the libcontainer
      config.

* utils_linux.go:
      Store the command line option value in the `CreateOpts` struct.

* libcontainer/rootfs_linux.go:
      In case that `--no-mount-fallback` is not set try to remount the
      bind filesystem again with the options nodev, nosuid, noexec,
      noatime, relatime, strictatime or nodiratime if they are set on
      the source filesystem.

* tests/integration/mounts_sshfs.bats:
      Add testcases and rework sshfs setup to allow specifying
      different mount options depending on the test case.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
rpluem-vf added a commit to rpluem-vf/runc that referenced this pull request Jul 12, 2023
@rpluem-vf
Fix bind mounts of filesystems with certain options set
a131dc9 
Currently bind mounts of filesystems with nodev, nosuid, noexec,
noatime, relatime, strictatime, nodiratime options set fail in rootless
mode if the same options are not set for the bind mount.
For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set.

Follow the same approach for nodev, nosuid, noexec, noatime, relatime,
strictatime, nodiratime but allow to revert back to the old behaviour
via the new `--no-mount-fallback` command line option.

Add a testcase to verify that bind mounts of filesystems with nodev,
nosuid, noexec, noatime options set work in rootless mode.
Add a testcase that mounts a nodev, nosuid, noexec, noatime filesystem
with a ro flag.
Add two further testcases that ensure that the above testcases would
fail if the `--no-mount-fallback` command line option is set.

* contrib/completions/bash/runc:
      Add `--no-mount-fallback` command line option for bash completion.

* create.go:
      Add `--no-mount-fallback` command line option.

* restore.go:
      Add `--no-mount-fallback` command line option.

* run.go:
      Add `--no-mount-fallback` command line option.

* libcontainer/configs/config.go:
      Add `NoMountFallback` field to the `Config` struct to store
      the command line option value.

* libcontainer/specconv/spec_linux.go:
      Add `NoMountFallback` field to the `CreateOpts` struct to store
      the command line option value and store it in the libcontainer
      config.

* utils_linux.go:
      Store the command line option value in the `CreateOpts` struct.

* libcontainer/rootfs_linux.go:
      In case that `--no-mount-fallback` is not set try to remount the
      bind filesystem again with the options nodev, nosuid, noexec,
      noatime, relatime, strictatime or nodiratime if they are set on
      the source filesystem.

* tests/integration/mounts_sshfs.bats:
      Add testcases and rework sshfs setup to allow specifying
      different mount options depending on the test case.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
kolyshkin pushed a commit to rpluem-vf/runc that referenced this pull request Jul 28, 2023
@rpluem-vf @kolyshkin
Fix bind mounts of filesystems with certain options set
da780e4 
Currently bind mounts of filesystems with nodev, nosuid, noexec,
noatime, relatime, strictatime, nodiratime options set fail in rootless
mode if the same options are not set for the bind mount.
For ro filesystems this was resolved by opencontainers#2570 by remounting again
with ro set.

Follow the same approach for nodev, nosuid, noexec, noatime, relatime,
strictatime, nodiratime but allow to revert back to the old behaviour
via the new `--no-mount-fallback` command line option.

Add a testcase to verify that bind mounts of filesystems with nodev,
nosuid, noexec, noatime options set work in rootless mode.
Add a testcase that mounts a nodev, nosuid, noexec, noatime filesystem
with a ro flag.
Add two further testcases that ensure that the above testcases would
fail if the `--no-mount-fallback` command line option is set.

* contrib/completions/bash/runc:
      Add `--no-mount-fallback` command line option for bash completion.

* create.go:
      Add `--no-mount-fallback` command line option.

* restore.go:
      Add `--no-mount-fallback` command line option.

* run.go:
      Add `--no-mount-fallback` command line option.

* libcontainer/configs/config.go:
      Add `NoMountFallback` field to the `Config` struct to store
      the command line option value.

* libcontainer/specconv/spec_linux.go:
      Add `NoMountFallback` field to the `CreateOpts` struct to store
      the command line option value and store it in the libcontainer
      config.

* utils_linux.go:
      Store the command line option value in the `CreateOpts` struct.

* libcontainer/rootfs_linux.go:
      In case that `--no-mount-fallback` is not set try to remount the
      bind filesystem again with the options nodev, nosuid, noexec,
      noatime, relatime, strictatime or nodiratime if they are set on
      the source filesystem.

* tests/integration/mounts_sshfs.bats:
      Add testcases and rework sshfs setup to allow specifying
      different mount options depending on the test case.

Signed-off-by: Ruediger Pluem <ruediger.pluem@vodafone.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cyphar cyphar cyphar left review comments

@kolyshkin kolyshkin kolyshkin approved these changes

@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

chmod on read-only tmpfs

4 participants

@EduardoVega @AkihiroSuda @kolyshkin @cyphar