github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-06-25 06:52:13 +00:00
Code Issues Projects Releases Wiki Activity

vc: do not follow symlink when umounting contanier host path

Browse Source 
So that if a guest changes it, we do not end up
propergating the error.

Fixes: #2474
Signed-off-by: Peng Tao <bergwolf@hyper.sh>
This commit is contained in:
Peng Tao 2020-02-19 04:46:02 -08:00
parent 44b09670b2
commit 5bf3231213
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
virtcontainers/container.go
View File

@ -590,7 +590,7 @@ func (c *Container) unmountHostMounts() error {
span, _ := c.trace("unmount") span, _ := c.trace("unmount")
span.SetTag("host-path", m.HostPath) span.SetTag("host-path", m.HostPath)
if err := syscall.Unmount(m.HostPath, syscall.MNT_DETACH); err != nil { if err := syscall.Unmount(m.HostPath, syscall.MNT_DETACH|UmountNoFollow); err != nil {
c.Logger().WithFields(logrus.Fields{ c.Logger().WithFields(logrus.Fields{
"host-path": m.HostPath, "host-path": m.HostPath,
"error": err, "error": err,

5
virtcontainers/mount.go
View File

@ -24,6 +24,9 @@ import (
// IPC is used. // IPC is used.
const DefaultShmSize = 65536 * 1024 const DefaultShmSize = 65536 * 1024
// Sadly golang/sys doesn't have UmountNoFollow although it's there since Linux 2.6.34
const UmountNoFollow = 0x8
var rootfsDir = "rootfs" var rootfsDir = "rootfs"
var systemMountPrefixes = []string{"/proc", "/sys"} var systemMountPrefixes = []string{"/proc", "/sys"}
@ -333,7 +336,7 @@ func bindUnmountContainerRootfs(ctx context.Context, sharedDir, sandboxID, cID s
defer span.Finish() defer span.Finish()
rootfsDest := filepath.Join(sharedDir, sandboxID, cID, rootfsDir) rootfsDest := filepath.Join(sharedDir, sandboxID, cID, rootfsDir)
err := syscall.Unmount(rootfsDest, syscall.MNT_DETACH) err := syscall.Unmount(rootfsDest, syscall.MNT_DETACH|UmountNoFollow)
if err == syscall.ENOENT { if err == syscall.ENOENT {
logrus.Warnf("%s: %s", err, rootfsDest) logrus.Warnf("%s: %s", err, rootfsDest)
return nil return nil