-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support recursive mount attrs ("rro", "rnosuid", "rnodev", ...) #3272
Conversation
2f6d86f
to
aa0b494
Compare
aa0b494
to
83e4c86
Compare
83e4c86
to
1c030d2
Compare
1c030d2
to
582f625
Compare
582f625
to
ca732aa
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
need rebase on top of #3281
ca732aa
to
e3de70a
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
e3de70a
to
9481cbe
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@cyphar PTAL |
Marked as a draft to avoid "merge conflict" with #3296 |
#3296 is merged, will re-review this once it's updated to add the new options to |
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
See MS_NOSYMFOLLOW in mount(2) https://man7.org/linux/man-pages/man2/mount.2.html Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The new mount option "rro" makes the mount point recursively read-only, by calling `mount_setattr(2)` with `MOUNT_ATTR_RDONLY` and `AT_RECURSIVE`. https://man7.org/linux/man-pages/man2/mount_setattr.2.html Requires kernel >= 5.12. The "rro" option string conforms to the proposal in util-linux/util-linux Issue 1501. Fix issue 2823 Similary, this commit also adds the following mount options: - rrw - r[no]{suid,dev,exec,relatime,atime,strictatime,diratime,symfollow} Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
9481cbe
to
382eba4
Compare
Updated. Ready for Review. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. We'll have to see how the runtime-spec changes go with regards to how we'll give full access to mount_setattr
.
I also wanted to ask -- one of the reasons mount_setattr was introduced was because our rootfs read-only setup only made / and not any lower mount points read-only. Did we want to change that behaviour too at some point (keeping in mind we'd need to do it carefully)?
Do you mean |
Yes and yeah we'd probably need to do more runtime-spec work (though it should be noted in my experience a lot of runc users expect |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
The new mount option "rro" makes the mount point recursively read-only, by calling
mount_setattr(2)
withMOUNT_ATTR_RDONLY
andAT_RECURSIVE
.https://man7.org/linux/man-pages/man2/mount_setattr.2.html
Requires kernel >= 5.12.
The "rro" option string conforms to the proposal in util-linux/util-linux#1501.
Fix #2823
Similary, this commit also adds the following mount options: