From 5bf32312131af572334eaf5a3ef5ccaf9e08a19f Mon Sep 17 00:00:00 2001 From: Peng Tao Date: Wed, 19 Feb 2020 04:46:02 -0800 Subject: [PATCH] vc: do not follow symlink when umounting contanier host path So that if a guest changes it, we do not end up propergating the error. Fixes: #2474 Signed-off-by: Peng Tao --- virtcontainers/container.go | 2 +- virtcontainers/mount.go | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/virtcontainers/container.go b/virtcontainers/container.go index 2a9f2269ee..def5938ecb 100644 --- a/virtcontainers/container.go +++ b/virtcontainers/container.go @@ -590,7 +590,7 @@ func (c *Container) unmountHostMounts() error { span, _ := c.trace("unmount") span.SetTag("host-path", m.HostPath) - if err := syscall.Unmount(m.HostPath, syscall.MNT_DETACH); err != nil { + if err := syscall.Unmount(m.HostPath, syscall.MNT_DETACH|UmountNoFollow); err != nil { c.Logger().WithFields(logrus.Fields{ "host-path": m.HostPath, "error": err, diff --git a/virtcontainers/mount.go b/virtcontainers/mount.go index 2a77285ece..a8f036f59e 100644 --- a/virtcontainers/mount.go +++ b/virtcontainers/mount.go @@ -24,6 +24,9 @@ import ( // IPC is used. const DefaultShmSize = 65536 * 1024 +// Sadly golang/sys doesn't have UmountNoFollow although it's there since Linux 2.6.34 +const UmountNoFollow = 0x8 + var rootfsDir = "rootfs" var systemMountPrefixes = []string{"/proc", "/sys"} @@ -333,7 +336,7 @@ func bindUnmountContainerRootfs(ctx context.Context, sharedDir, sandboxID, cID s defer span.Finish() rootfsDest := filepath.Join(sharedDir, sandboxID, cID, rootfsDir) - err := syscall.Unmount(rootfsDest, syscall.MNT_DETACH) + err := syscall.Unmount(rootfsDest, syscall.MNT_DETACH|UmountNoFollow) if err == syscall.ENOENT { logrus.Warnf("%s: %s", err, rootfsDest) return nil