77 lines
2.7 KiB
Diff
77 lines
2.7 KiB
Diff
From 0d04d291e8b9dcee0fcdf4b757e41d0e77b1491f Mon Sep 17 00:00:00 2001
|
|
From: zhongjiawei <zhongjiawei1@huawei.com>
|
|
Date: Mon, 24 Jul 2023 17:25:43 +0800
|
|
Subject: [PATCH] runc:support namespaced kernel params can be changed in
|
|
system container
|
|
|
|
---
|
|
libcontainer/rootfs_linux.go | 26 ++++++++++++++++++++++++++
|
|
libcontainer/standard_init_linux.go | 7 +++++++
|
|
2 files changed, 33 insertions(+)
|
|
|
|
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
|
|
index 54520ad..e7de071 100644
|
|
--- a/libcontainer/rootfs_linux.go
|
|
+++ b/libcontainer/rootfs_linux.go
|
|
@@ -435,6 +435,9 @@ func mountToRootfs(m *configs.Mount, c *mountConfig) error {
|
|
} else if !fi.IsDir() {
|
|
return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device)
|
|
}
|
|
+ if strings.HasPrefix(m.Destination, "/proc/sys/") {
|
|
+ return nil
|
|
+ }
|
|
if err := os.MkdirAll(dest, 0o755); err != nil {
|
|
return err
|
|
}
|
|
@@ -1033,6 +1036,29 @@ func readonlyPath(path string) error {
|
|
return nil
|
|
}
|
|
|
|
+// remountReadWrite will bind over the top of an existing path and ensure that it is read-write.
|
|
+func remountReadWrite(path string) error {
|
|
+ for i := 0; i < 5; i++ {
|
|
+ if err := syscall.Mount("", path, "", syscall.MS_REMOUNT, ""); err != nil && !os.IsNotExist(err) {
|
|
+ switch err {
|
|
+ case syscall.EINVAL:
|
|
+ // Probably not a mountpoint, use bind-mount
|
|
+ if err := syscall.Mount(path, path, "", syscall.MS_BIND, ""); err != nil {
|
|
+ return err
|
|
+ }
|
|
+ return syscall.Mount(path, path, "", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_REC|defaultMountFlags, "")
|
|
+ case syscall.EBUSY:
|
|
+ time.Sleep(100 * time.Millisecond)
|
|
+ continue
|
|
+ default:
|
|
+ return err
|
|
+ }
|
|
+ }
|
|
+ return nil
|
|
+ }
|
|
+ return fmt.Errorf("unable to mount %s as readwrite max retries reached", path)
|
|
+}
|
|
+
|
|
// remountReadonly will remount an existing mount point and ensure that it is read-only.
|
|
func remountReadonly(m *configs.Mount) error {
|
|
var (
|
|
diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go
|
|
index eaa73ba..84883c2 100644
|
|
--- a/libcontainer/standard_init_linux.go
|
|
+++ b/libcontainer/standard_init_linux.go
|
|
@@ -141,6 +141,13 @@ func (l *linuxStandardInit) Init() error {
|
|
return fmt.Errorf("can't make %q read-only: %w", path, err)
|
|
}
|
|
}
|
|
+ for _, m := range l.config.Config.Mounts {
|
|
+ if m.Flags&syscall.MS_RDONLY == 0 && m.Device == "proc" && strings.HasPrefix(m.Destination, "/proc/sys/") {
|
|
+ if err := remountReadWrite(m.Destination); err != nil {
|
|
+ return err
|
|
+ }
|
|
+ }
|
|
+ }
|
|
for _, path := range l.config.Config.MaskPaths {
|
|
if err := maskPath(path, l.config.Config.MountLabel); err != nil {
|
|
return fmt.Errorf("can't mask path %s: %w", path, err)
|
|
--
|
|
2.33.0
|
|
|