mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

rootfs: improve error messages for bind-mount vfs flag setting

Browse Source 
While debugging an issue involving failing mounts, I discovered that
just returning the plain mount error message when we are in the fallback
code for handling locked mounts leads to unnecessary confusion.

It also doesn't help that podman currently forcefully sets "rw" on
mounts, which means that rootless containers are likely to hit the
locked mounts issue fairly often.

So we should improve our error messages to explain why the mount is
failing in the locked flags case.

Fixes: 7c71a22705 ("rootfs: remove --no-mount-fallback and finally fix MS_REMOUNT")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
This commit is contained in:
Aleksa Sarai
2025-04-18 14:11:28 +10:00
parent 30302a2850
commit 58c3ab77b0
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/rootfs_linux.go
+13 -5
View File
@@ -666,11 +666,17 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
return err
}
srcFlags := statfsToMountFlags(*st)
logrus.Debugf(
"working around failure to set vfs flags on bind-mount %s: srcFlags=%s flagsSet=%s flagsClr=%s: %v",
m.Destination, stringifyMountFlags(srcFlags),
stringifyMountFlags(m.Flags), stringifyMountFlags(m.ClearedFlags), mountErr)
// If the user explicitly request one of the locked flags *not*
// be set, we need to return an error to avoid producing mounts
// that don't match the user's request.
if srcFlags&m.ClearedFlags&mntLockFlags != 0 {
return mountErr
if cannotClearFlags := srcFlags & m.ClearedFlags & mntLockFlags; cannotClearFlags != 0 {
return fmt.Errorf("cannot clear locked flags %s: %w", stringifyMountFlags(cannotClearFlags), mountErr)
}
// If an MS_*ATIME flag was requested, it must match the
@@ -691,17 +697,19 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
// MS_STRICTATIME mounts even if the user requested MS_RELATIME
// or MS_NOATIME.
if m.Flags&mntAtimeFlags != 0 && m.Flags&mntAtimeFlags != srcFlags&mntAtimeFlags {
return mountErr
return fmt.Errorf("cannot change locked atime flags %s: %w", stringifyMountFlags(srcFlags&mntAtimeFlags), mountErr)
}
// Retry the mount with the existing lockable mount flags
// applied.
flags |= srcFlags & mntLockFlags
mountErr = mountViaFds("", nil, m.Destination, dstFd, "", uintptr(flags), "")
logrus.Debugf("remount retry: srcFlags=0x%x flagsSet=0x%x flagsClr=0x%x: %v", srcFlags, m.Flags, m.ClearedFlags, mountErr)
if mountErr != nil {
mountErr = fmt.Errorf("remount with locked flags %s re-applied: %w", stringifyMountFlags(srcFlags&mntLockFlags), mountErr)
}
return mountErr
}); err != nil {
return err
return fmt.Errorf("failed to set user-requested vfs flags on bind-mount: %w", err)
}
}