containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

spec: add nosuid,noexec,nodev to ro bind mount 

runc fails to change the ro mode of a rootless bind mount if the other
flags are not kept.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano 2019-01-11 10:34:27 +01:00
parent 36d96c19f9
commit b3e7be7a0b
No known key found for this signature in database
GPG Key ID: E4730F97F60286ED
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libpod/container_internal_linux.go
View File

@ -227,7 +227,7 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
Options: []string{"bind", "private"}, Options: []string{"bind", "private"},
} }
if c.IsReadOnly() && dstPath != "/dev/shm" { if c.IsReadOnly() && dstPath != "/dev/shm" {
newMount.Options = append(newMount.Options, "ro") newMount.Options = append(newMount.Options, "ro", "nosuid", "noexec", "nodev")
} }
if !MountExists(g.Mounts(), dstPath) { if !MountExists(g.Mounts(), dstPath) {
g.AddMount(newMount) g.AddMount(newMount)