woj/nsjail
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch '_test_switchroot_alternative'

Browse Source
This commit is contained in:
Eli Zrihen 2021-07-13 15:40:21 +03:00
parent 0e0e34c33d
commit 99507c5920
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
mnt.cc
View File

@ -426,19 +426,22 @@ static bool initCloneNs(nsjconf_t* nsjconf) {
* and there is no other file system that is mounted on top of it.In such systems,
* there is no option to pivot_root!
* For more information, see kernel.org/doc/Documentation/filesystems/ramfs-rootfs-initramfs.txt.
* switch_root alternative:
* Innstead of un-mounting the old rootfs, it is over mounted by moving the new root to it.
* This way, we prevent the process from hacking its way back into the old root.
* The alternative is to override '/' mount point with the new root within the mount namespace.
*/
if (chdir(destdir->c_str()) == -1) {
PLOG_E("chdir('%s')", destdir->c_str());
return false;
}
/* mount moving the new root on top of '/'. This operation is atomic and doesn't involve
un-mounting '/' at any stage */
if (mount(".", "/", NULL, MS_MOVE, NULL) == -1) {
PLOG_E("mount('/', %s, NULL, MS_MOVE, NULL)", destdir->c_str());
/* Override '/' mount point with the target chroot dir */
if (mount(".", "/", NULL, MS_REC | MS_BIND, NULL) == -1) {
PLOG_E("mount('.', '/', NULL, MS_REC | MS_BIND, NULL)");
return false;
}
/* Remount '/' as private so that there will be no mount propagation */
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) == -1) {
PLOG_E("mount(NULL, '/', NULL, MS_REC | MS_BIND, NULL)");
return false;
}