[libvirt] [PATCH 2/2] LXC: make sure netns been enabled when trying to enable userns

Chen Hanxiao chenhanxiao at cn.fujitsu.com
Mon Mar 23 03:46:23 UTC 2015


Discussed at:
http://www.redhat.com/archives/libvir-list/2015-March/msg01023.html

Signed-off-by: Chen Hanxiao <chenhanxiao at cn.fujitsu.com>
---
 src/lxc/lxc_container.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
index e34968a..69a8f2f 100644
--- a/src/lxc/lxc_container.c
+++ b/src/lxc/lxc_container.c
@@ -941,6 +941,16 @@ static int lxcContainerMountBasicFS(bool userns_enabled,
         bool bindOverReadonly;
         virLXCBasicMountInfo const *mnt = &lxcBasicMounts[i];
 
+        /* When enable userns but disable netns, kernel will
+         * forbid us doing a new fresh mount for sysfs for security reason.
+         * So we should not allow this.
+         */
+        if (userns_enabled && netns_disabled) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                           _("Userns could not be enabled without netns"));
+            goto cleanup;
+        }
+
         VIR_DEBUG("Processing %s -> %s",
                   mnt->src, mnt->dst);
 
-- 
2.1.0




More information about the libvir-list mailing list