diff --git a/src/runtime/virtcontainers/container.go b/src/runtime/virtcontainers/container.go index 21f18f35d7..87e4cf45e6 100644 --- a/src/runtime/virtcontainers/container.go +++ b/src/runtime/virtcontainers/container.go @@ -435,7 +435,7 @@ func (c *Container) setContainerState(state types.StateString) error { return nil } -func (c *Container) shareFiles(m Mount, idx int, hostSharedDir, guestSharedDir string) (string, bool, error) { +func (c *Container) shareFiles(m Mount, idx int, hostSharedDir, hostMountDir, guestSharedDir string) (string, bool, error) { randBytes, err := utils.GenerateRandomBytes(8) if err != nil { return "", false, err @@ -469,12 +469,19 @@ func (c *Container) shareFiles(m Mount, idx int, hostSharedDir, guestSharedDir s } } else { // These mounts are created in the shared dir - mountDest := filepath.Join(hostSharedDir, filename) - if err := bindMount(c.ctx, m.Source, mountDest, false, "private"); err != nil { + mountDest := filepath.Join(hostMountDir, filename) + if err := bindMount(c.ctx, m.Source, mountDest, m.ReadOnly, "private"); err != nil { return "", false, err } // Save HostPath mount value into the mount list of the container. c.mounts[idx].HostPath = mountDest + // bindmount remount event is not propagated to mount subtrees, so we have to remount the shared dir mountpoint directly. + if m.ReadOnly { + mountDest = filepath.Join(hostSharedDir, filename) + if err := remountRo(c.ctx, mountDest); err != nil { + return "", false, err + } + } } return guestDest, false, nil @@ -485,7 +492,7 @@ func (c *Container) shareFiles(m Mount, idx int, hostSharedDir, guestSharedDir s // It also updates the container mount list with the HostPath info, and store // container mounts to the storage. This way, we will have the HostPath info // available when we will need to unmount those mounts. -func (c *Container) mountSharedDirMounts(hostSharedDir, guestSharedDir string) (sharedDirMounts map[string]Mount, ignoredMounts map[string]Mount, err error) { +func (c *Container) mountSharedDirMounts(hostSharedDir, hostMountDir, guestSharedDir string) (sharedDirMounts map[string]Mount, ignoredMounts map[string]Mount, err error) { sharedDirMounts = make(map[string]Mount) ignoredMounts = make(map[string]Mount) var devicesToDetach []string @@ -535,7 +542,7 @@ func (c *Container) mountSharedDirMounts(hostSharedDir, guestSharedDir string) ( var ignore bool var guestDest string - guestDest, ignore, err = c.shareFiles(m, idx, hostSharedDir, guestSharedDir) + guestDest, ignore, err = c.shareFiles(m, idx, hostSharedDir, hostMountDir, guestSharedDir) if err != nil { return nil, nil, err } @@ -546,22 +553,12 @@ func (c *Container) mountSharedDirMounts(hostSharedDir, guestSharedDir string) ( continue } - // Check if mount is readonly, let the agent handle the readonly mount - // within the VM. - readonly := false - for _, flag := range m.Options { - if flag == "ro" { - readonly = true - break - } - } - sharedDirMount := Mount{ Source: guestDest, Destination: m.Destination, Type: m.Type, Options: m.Options, - ReadOnly: readonly, + ReadOnly: m.ReadOnly, } sharedDirMounts[sharedDirMount.Destination] = sharedDirMount diff --git a/src/runtime/virtcontainers/kata_agent.go b/src/runtime/virtcontainers/kata_agent.go index b88bec4488..9f5228373f 100644 --- a/src/runtime/virtcontainers/kata_agent.go +++ b/src/runtime/virtcontainers/kata_agent.go @@ -1256,7 +1256,7 @@ func (k *kataAgent) createContainer(sandbox *Sandbox, c *Container) (p *Process, } // Handle container mounts - newMounts, ignoredMounts, err := c.mountSharedDirMounts(getMountPath(sandbox.id), kataGuestSharedDir()) + newMounts, ignoredMounts, err := c.mountSharedDirMounts(getSharePath(sandbox.id), getMountPath(sandbox.id), kataGuestSharedDir()) if err != nil { return nil, err } diff --git a/src/runtime/virtcontainers/mount.go b/src/runtime/virtcontainers/mount.go index 6adf0d40a9..604922dfe8 100644 --- a/src/runtime/virtcontainers/mount.go +++ b/src/runtime/virtcontainers/mount.go @@ -277,6 +277,11 @@ func remount(ctx context.Context, mountflags uintptr, src string) error { return nil } +// remount a mount point as readonly +func remountRo(ctx context.Context, src string) error { + return remount(ctx, syscall.MS_BIND|syscall.MS_RDONLY, src) +} + // bindMountContainerRootfs bind mounts a container rootfs into a 9pfs shared // directory between the guest and the host. func bindMountContainerRootfs(ctx context.Context, shareDir, cid, cRootFs string, readonly bool) error { diff --git a/src/runtime/virtcontainers/pkg/oci/utils.go b/src/runtime/virtcontainers/pkg/oci/utils.go index 755e3c6b45..26c44992e3 100644 --- a/src/runtime/virtcontainers/pkg/oci/utils.go +++ b/src/runtime/virtcontainers/pkg/oci/utils.go @@ -160,11 +160,19 @@ func cmdEnvs(spec specs.Spec, envs []types.EnvVar) []types.EnvVar { } func newMount(m specs.Mount) vc.Mount { + readonly := false + for _, flag := range m.Options { + if flag == "ro" { + readonly = true + break + } + } return vc.Mount{ Source: m.Source, Destination: m.Destination, Type: m.Type, Options: m.Options, + ReadOnly: readonly, } } diff --git a/src/runtime/virtcontainers/sandbox_test.go b/src/runtime/virtcontainers/sandbox_test.go index 6e6dd752c1..9a9d0c1e4a 100644 --- a/src/runtime/virtcontainers/sandbox_test.go +++ b/src/runtime/virtcontainers/sandbox_test.go @@ -1175,7 +1175,7 @@ func TestPreAddDevice(t *testing.T) { }, } - mounts, ignoreMounts, err := container.mountSharedDirMounts("", "") + mounts, ignoreMounts, err := container.mountSharedDirMounts("", "", "") assert.Nil(t, err) assert.Equal(t, len(mounts), 0, "mounts should contain nothing because it only contains a block device") diff --git a/versions.yaml b/versions.yaml index 1ba7d2d85e..8a469c16d9 100644 --- a/versions.yaml +++ b/versions.yaml @@ -179,7 +179,7 @@ externals: description: | OCI-based Kubernetes Container Runtime Interface implementation url: "https://github.com/cri-o/cri-o" - version: "v1.18.4" + version: "v1.18.3" meta: openshift: "6273bea4c9ed788aeb3d051ebf2d030060c05b6c" crictl: 1.0.0-beta.2