mirror of
https://github.com/opencontainers/runc.git
synced 2026-11-06 05:17:05 +00:00
Kir Kolyshkin
bd825f99bc
When the container does not have its own mount namespace, prepareRoot
is run in the host mount namespace. Since commit 91ca3314 ("chroot when
no mount namespaces is provided"), this results in host's / being
recursively made a slave (which, in the host mount namespace, means
private), and the parent mount of the container rootfs being made
private (or slave).
In the host mount namespace, do not change the propagation of the
existing mounts. Instead, make the new rootfs mount a slave, so that
container mounts do not propagate to the host and other mount
namespaces (otherwise, if the rootfs parent mount is shared, every
container mount appears twice in the host mount namespace, and is
propagated to all its slaves).
Add an integration test.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
53 lines
1.6 KiB
Bash
53 lines
1.6 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
requires root
|
|
setup_busybox
|
|
}
|
|
|
|
function teardown() {
|
|
[ ! -v ROOT ] && return 0 # nothing to teardown
|
|
|
|
# XXX runc does not unmount a container which
|
|
# shares mount namespace with the host.
|
|
umount -R --lazy "$ROOT"/bundle/rootfs
|
|
|
|
teardown_bundle
|
|
}
|
|
|
|
# This test goes first, since without the fix, any test which runs
|
|
# a container in the host mount namespace changes the host mounts
|
|
# propagation, so the bug would go unnoticed.
|
|
@test "runc run [host mount ns] must not change host mounts propagation" {
|
|
update_config ' .process.args = ["true"]
|
|
| .linux.namespaces -= [{"type": "mount"}]
|
|
| .linux.maskedPaths = []
|
|
| .linux.readonlyPaths = []
|
|
| .root.readonly = false'
|
|
|
|
# Check / and the mount the container bundle resides on.
|
|
before=$(findmnt -n -o TARGET,PROPAGATION / && findmnt -n -o TARGET,PROPAGATION -T "$ROOT/bundle")
|
|
run -0 runc run test_host_mntns
|
|
after=$(findmnt -n -o TARGET,PROPAGATION / && findmnt -n -o TARGET,PROPAGATION -T "$ROOT/bundle")
|
|
echo "before: $before"
|
|
echo "after: $after"
|
|
[ "$before" = "$after" ]
|
|
}
|
|
|
|
@test "runc run [host mount ns + hooks]" {
|
|
update_config ' .process.args = ["/bin/echo", "Hello World"]
|
|
| .hooks |= . + {"createRuntime": [{"path": "/bin/sh", "args": ["/bin/sh", "-c", "touch createRuntimeHook.$$"]}]}
|
|
| .linux.namespaces -= [{"type": "mount"}]
|
|
| .linux.maskedPaths = []
|
|
| .linux.readonlyPaths = []
|
|
| .root.readonly = false'
|
|
run -0 runc run test_host_mntns
|
|
run -0 runc delete -f test_host_mntns
|
|
|
|
# There should be one such file.
|
|
run -0 ls createRuntimeHook.*
|
|
[ "$(echo "$output" | wc -w)" -eq 1 ]
|
|
}
|