[libvirt] [PATCH] Mount fresh instance of sysfs in LXC
Eric Blake
eblake at redhat.com
Thu May 10 20:25:58 UTC 2012
On 05/10/2012 10:17 AM, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange" <berrange at redhat.com>
>
> Currently to make sysfs readonly, we remount the existing
> instance and then bind it readonly. Unfortunately this means
> sysfs is still showing device objects wrt the host OS namespace.
> We need it to reflect the container namespace, so we must mount
> a completely new instance of it.
>
> * src/lxc/lxc_container.c: Mount fresh sysfs instance
> ---
> src/lxc/lxc_container.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
> index b953646..77d33e1 100644
> --- a/src/lxc/lxc_container.c
> +++ b/src/lxc/lxc_container.c
> @@ -441,8 +441,7 @@ static int lxcContainerMountBasicFS(lxc_child_argv_t *argv, const char *srcprefi
> { false, "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV },
> { false, "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND },
> { false, "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY },
> - { true, "/sys", "/sys", NULL, NULL, MS_BIND },
> - { true, "/sys", "/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY },
> + { false, "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY },
ACK.
--
Eric Blake eblake at redhat.com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 620 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20120510/aa107569/attachment-0001.sig>
More information about the libvir-list
mailing list