-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support recursive mount attrs ("rro", "rnosuid", "rnodev", ...)
The new mount option "rro" makes the mount point recursively read-only, by calling `mount_setattr(2)` with `MOUNT_ATTR_RDONLY` and `AT_RECURSIVE`. https://man7.org/linux/man-pages/man2/mount_setattr.2.html Requires kernel >= 5.12. The "rro" option string conforms to the proposal in util-linux/util-linux Issue 1501. Fix issue 2823 Similary, this commit also adds the following mount options: - rrw - r[no]{suid,dev,exec,relatime,atime,strictatime,diratime,symfollow} - [no]symfollow Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
- Loading branch information
1 parent
c1103d9
commit 83e4c86
Showing
5 changed files
with
211 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| // Package syscallutil provdes addenda to golang.org/x/sys/unix | ||
| package syscallutil | ||
|
|
||
| import ( | ||
| "unsafe" | ||
|
|
||
| "golang.org/x/sys/unix" | ||
| ) | ||
|
|
||
| // nolint | ||
| const ( | ||
| AT_EMPTY_PATH = unix.AT_EMPTY_PATH | ||
| AT_RECURSIVE = 0x8000 // https://github.com/torvalds/linux/blob/v5.12/include/uapi/linux/fcntl.h#L112 | ||
| AT_SYMLINK_NOFOLLOW = unix.AT_SYMLINK_NOFOLLOW | ||
| AT_NO_AUTOMOUNT = unix.AT_NO_AUTOMOUNT | ||
| MOUNT_ATTR_RDONLY = 0x00000001 // since kernel 5.12, https://github.com/torvalds/linux/blob/v5.12/include/uapi/linux/mount.h#L113 | ||
| MOUNT_ATTR_NOSUID = 0x00000002 // since kernel 5.12 | ||
| MOUNT_ATTR_NODEV = 0x00000004 // since kernel 5.12 | ||
| MOUNT_ATTR_NOEXEC = 0x00000008 // since kernel 5.12 | ||
| MOUNT_ATTR__ATIME = 0x00000070 // since kernel 5.12 | ||
| MOUNT_ATTR_RELATIME = 0x00000000 // since kernel 5.12 | ||
| MOUNT_ATTR_NOATIME = 0x00000010 // since kernel 5.12 | ||
| MOUNT_ATTR_STRICTATIME = 0x00000020 // since kernel 5.12 | ||
| MOUNT_ATTR_NODIRATIME = 0x00000080 // since kernel 5.12 | ||
| MOUNT_ATTR_IDMAP = 0x00100000 // since kernel 5.12 | ||
| MOUNT_ATTR_NOSYMFOLLOW = 0x00200000 // since kernel 5.14, https://github.com/torvalds/linux/blob/v5.14/include/uapi/linux/mount.h#L123 | ||
| MOUNT_ATTR_SIZE_VER0 = 32 // https://github.com/torvalds/linux/blob/v5.12/include/uapi/linux/mount.h#L135 | ||
| ) | ||
|
|
||
| // MountAttr corresponds to struct mount_attr, version 0, appeared in kernel 5.12. | ||
| // https://github.com/torvalds/linux/blob/v5.12/include/uapi/linux/mount.h#L124-L132 | ||
| type MountAttr struct { | ||
| AttrSet uint64 // __u64 attr_set | ||
| AttrClr uint64 // __u64 attr_clr | ||
| Propagation uint64 // __u64 propagation | ||
| UsernsFd uint64 // __u64 userns_fd | ||
| } | ||
|
|
||
| // MountSetattr is a wrapper for mount_setattr(2). | ||
| // | ||
| // int syscall(SYS_mount_setattr, int dirfd, const char *pathname, unsigned int flags, struct mount_attr *attr, size_t size); | ||
| // | ||
| // Requires kernel >= 5.12. | ||
| // https://man7.org/linux/man-pages/man2/mount_setattr.2.html | ||
| func MountSetattr(dirfd int, pathname string, flags uint, attr *MountAttr) error { | ||
| pathnamePtr, err := unix.BytePtrFromString(pathname) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| _, _, errno := unix.Syscall6(unix.SYS_MOUNT_SETATTR, | ||
| uintptr(dirfd), uintptr(unsafe.Pointer(pathnamePtr)), uintptr(flags), | ||
| uintptr(unsafe.Pointer(attr)), unsafe.Sizeof(*attr), 0) | ||
| if errno != 0 { | ||
| return errno | ||
| } | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| #!/usr/bin/env bats | ||
|
|
||
| load helpers | ||
|
|
||
| TESTVOLUME="${BATS_RUN_TMPDIR}/mounts_recursive" | ||
|
|
||
| function setup_volume() { | ||
| # requires root (in the current user namespace) to mount tmpfs outside runc | ||
| requires root | ||
|
|
||
| mkdir -p "${TESTVOLUME}" | ||
| mount -t tmpfs none "${TESTVOLUME}" | ||
| echo "foo" >"${TESTVOLUME}/foo" | ||
|
|
||
| mkdir "${TESTVOLUME}/subvol" | ||
| mount -t tmpfs none "${TESTVOLUME}/subvol" | ||
| echo "bar" >"${TESTVOLUME}/subvol/bar" | ||
| } | ||
|
|
||
| function teardown_volume() { | ||
| umount -R "${TESTVOLUME}" | ||
| } | ||
|
|
||
| function setup() { | ||
| setup_volume | ||
| setup_busybox | ||
| } | ||
|
|
||
| function teardown() { | ||
| teardown_volume | ||
| teardown_bundle | ||
| } | ||
|
|
||
| @test "runc run [rbind,ro mount is read-only but not recursively]" { | ||
| update_config ".mounts += [{source: \"${TESTVOLUME}\" , destination: \"/mnt\", options: [\"rbind\",\"ro\"]}]" | ||
|
|
||
| runc run -d --console-socket "$CONSOLE_SOCKET" test_rbind_ro | ||
| [ "$status" -eq 0 ] | ||
|
|
||
| runc exec test_rbind_ro touch /mnt/foo | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"Read-only file system"* ]] | ||
|
|
||
| runc exec test_rbind_ro touch /mnt/subvol/bar | ||
| [ "$status" -eq 0 ] | ||
| } | ||
|
|
||
| @test "runc run [rbind,rro mount is recursively read-only]" { | ||
| requires_kernel 5.12 | ||
| update_config ".mounts += [{source: \"${TESTVOLUME}\" , destination: \"/mnt\", options: [\"rbind\",\"rro\"]}]" | ||
|
|
||
| runc run -d --console-socket "$CONSOLE_SOCKET" test_rbind_rro | ||
| [ "$status" -eq 0 ] | ||
|
|
||
| runc exec test_rbind_rro touch /mnt/foo | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"Read-only file system"* ]] | ||
|
|
||
| runc exec test_rbind_rro touch /mnt/subvol/bar | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"Read-only file system"* ]] | ||
| } | ||
|
|
||
| @test "runc run [rbind,ro,rro mount is recursively read-only too]" { | ||
| requires_kernel 5.12 | ||
| update_config ".mounts += [{source: \"${TESTVOLUME}\" , destination: \"/mnt\", options: [\"rbind\",\"ro\",\"rro\"]}]" | ||
|
|
||
| runc run -d --console-socket "$CONSOLE_SOCKET" test_rbind_ro_rro | ||
| [ "$status" -eq 0 ] | ||
|
|
||
| runc exec test_rbind_ro_rro touch /mnt/foo | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"Read-only file system"* ]] | ||
|
|
||
| runc exec test_rbind_ro_rro touch /mnt/subvol/bar | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"Read-only file system"* ]] | ||
| } |