NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

Skip any files which are not mounted on the host

Browse Source 
Currently the LXC container tries to skip selinux/securityfs
mounts if the directory does not exist in the filesystem,
or if SELinux is disabled.

The former check is flawed because the /sys/fs/selinux
or /sys/kernel/securityfs directories may exist in sysfs
even if the mount type is disabled. Instead of just doing
an access() check, use an virFileIsMounted() to see if
the FS is actually present in the host OS. This also
avoids the need to check is_selinux_enabled().

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2013-10-07 13:12:15 +01:00
parent bf8874025e
commit 9ecbd38c4c
1 changed files with 23 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
src/lxc/lxc_container.c
View File

@ -756,15 +756,16 @@ typedef struct {
const char *type; const char *type;
int mflags; int mflags;
bool skipUserNS; bool skipUserNS;
bool skipUnmounted;
} virLXCBasicMountInfo; } virLXCBasicMountInfo;
static const virLXCBasicMountInfo lxcBasicMounts[] = { static const virLXCBasicMountInfo lxcBasicMounts[] = {
{ "proc", "/proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, false }, { "proc", "/proc", "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, false, false },
{ "/proc/sys", "/proc/sys", NULL, MS_BIND|MS_RDONLY, false }, { "/proc/sys", "/proc/sys", NULL, MS_BIND|MS_RDONLY, false, false },
{ "sysfs", "/sys", "sysfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, false }, { "sysfs", "/sys", "sysfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, false, false },
{ "securityfs", "/sys/kernel/security", "securityfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true }, { "securityfs", "/sys/kernel/security", "securityfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true },
#if WITH_SELINUX #if WITH_SELINUX
{ SELINUX_MOUNT, SELINUX_MOUNT, "selinuxfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true }, { SELINUX_MOUNT, SELINUX_MOUNT, "selinuxfs", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY, true, true },
#endif #endif
}; };
@ -851,16 +852,24 @@ static int lxcContainerMountBasicFS(bool userns_enabled)
VIR_DEBUG("Processing %s -> %s", VIR_DEBUG("Processing %s -> %s",
mnt->src, mnt->dst); mnt->src, mnt->dst);
/* Skip if mount doesn't exist in source */ if (mnt->skipUnmounted) {
if ((mnt->src[0] == '/') && char *hostdir;
(access(mnt->src, R_OK) < 0)) int ret;
continue;
#if WITH_SELINUX if (virAsprintf(&hostdir, "/.oldroot%s", mnt->dst) < 0)
if (STREQ(mnt->src, SELINUX_MOUNT) && goto cleanup;
!is_selinux_enabled())
continue; ret = virFileIsMountPoint(hostdir);
#endif VIR_FREE(hostdir);
if (ret < 0)
goto cleanup;
if (ret == 0) {
VIR_DEBUG("Skipping '%s' which isn't mounted in host",
mnt->dst);
continue;
}
}
if (mnt->skipUserNS && userns_enabled) { if (mnt->skipUserNS && userns_enabled) {
VIR_DEBUG("Skipping due to user ns enablement"); VIR_DEBUG("Skipping due to user ns enablement");