diff options
Diffstat (limited to 'recipes-extended/libvirt/libvirt/LXC-Don-t-mount-securityfs-when-user-namespace-enabl.patch')
-rw-r--r-- | recipes-extended/libvirt/libvirt/LXC-Don-t-mount-securityfs-when-user-namespace-enabl.patch | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/recipes-extended/libvirt/libvirt/LXC-Don-t-mount-securityfs-when-user-namespace-enabl.patch b/recipes-extended/libvirt/libvirt/LXC-Don-t-mount-securityfs-when-user-namespace-enabl.patch new file mode 100644 index 00000000..40f8dd9b --- /dev/null +++ b/recipes-extended/libvirt/libvirt/LXC-Don-t-mount-securityfs-when-user-namespace-enabl.patch | |||
@@ -0,0 +1,52 @@ | |||
1 | From 1583dfda7c4e5ad71efe0615c06e5676528d8203 Mon Sep 17 00:00:00 2001 | ||
2 | From: Gao feng <gaofeng@cn.fujitsu.com> | ||
3 | Date: Thu, 5 Sep 2013 11:50:40 +0100 | ||
4 | Subject: [PATCH] LXC: Don't mount securityfs when user namespace enabled | ||
5 | |||
6 | commit 1583dfda7c4e5ad71efe0615c06e5676528d8203 from | ||
7 | git://libvirt.org/libvirt.git | ||
8 | |||
9 | Right now, securityfs is disallowed to be mounted in non-initial | ||
10 | user namespace, so we must avoid trying to mount securityfs in | ||
11 | a container which has user namespace enabled. | ||
12 | |||
13 | Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> | ||
14 | --- | ||
15 | src/lxc/lxc_container.c | 7 +++++-- | ||
16 | 1 file changed, 5 insertions(+), 2 deletions(-) | ||
17 | |||
18 | diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c | ||
19 | index 8abaea0..c41ab40 100644 | ||
20 | --- a/src/lxc/lxc_container.c | ||
21 | +++ b/src/lxc/lxc_container.c | ||
22 | @@ -750,7 +750,7 @@ err: | ||
23 | } | ||
24 | |||
25 | |||
26 | -static int lxcContainerMountBasicFS(void) | ||
27 | +static int lxcContainerMountBasicFS(bool userns_enabled) | ||
28 | { | ||
29 | const struct { | ||
30 | const char *src; | ||
31 | @@ -801,6 +801,9 @@ static int lxcContainerMountBasicFS(void) | ||
32 | continue; | ||
33 | #endif | ||
34 | |||
35 | + if (STREQ(mnts[i].src, "securityfs") && userns_enabled) | ||
36 | + continue; | ||
37 | + | ||
38 | if (virFileMakePath(mnts[i].dst) < 0) { | ||
39 | virReportSystemError(errno, | ||
40 | _("Failed to mkdir %s"), | ||
41 | @@ -1530,7 +1533,7 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef, | ||
42 | goto cleanup; | ||
43 | |||
44 | /* Mounts the core /proc, /sys, etc filesystems */ | ||
45 | - if (lxcContainerMountBasicFS() < 0) | ||
46 | + if (lxcContainerMountBasicFS(vmDef->idmap.nuidmap) < 0) | ||
47 | goto cleanup; | ||
48 | |||
49 | /* Mounts /proc/meminfo etc sysinfo */ | ||
50 | -- | ||
51 | 1.8.1.2 | ||
52 | |||