From 58c3ab77b0ab39f25d38578a96e0ca36ea60be13 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Fri, 18 Apr 2025 14:11:28 +1000 Subject: [PATCH] rootfs: improve error messages for bind-mount vfs flag setting While debugging an issue involving failing mounts, I discovered that just returning the plain mount error message when we are in the fallback code for handling locked mounts leads to unnecessary confusion. It also doesn't help that podman currently forcefully sets "rw" on mounts, which means that rootless containers are likely to hit the locked mounts issue fairly often. So we should improve our error messages to explain why the mount is failing in the locked flags case. Fixes: 7c71a2270547 ("rootfs: remove --no-mount-fallback and finally fix MS_REMOUNT") Signed-off-by: Aleksa Sarai --- libcontainer/rootfs_linux.go | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 7d7e957dd..51bfd12b9 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -666,11 +666,17 @@ func mountToRootfs(c *mountConfig, m mountEntry) error { return err } srcFlags := statfsToMountFlags(*st) + + logrus.Debugf( + "working around failure to set vfs flags on bind-mount %s: srcFlags=%s flagsSet=%s flagsClr=%s: %v", + m.Destination, stringifyMountFlags(srcFlags), + stringifyMountFlags(m.Flags), stringifyMountFlags(m.ClearedFlags), mountErr) + // If the user explicitly request one of the locked flags *not* // be set, we need to return an error to avoid producing mounts // that don't match the user's request. - if srcFlags&m.ClearedFlags&mntLockFlags != 0 { - return mountErr + if cannotClearFlags := srcFlags & m.ClearedFlags & mntLockFlags; cannotClearFlags != 0 { + return fmt.Errorf("cannot clear locked flags %s: %w", stringifyMountFlags(cannotClearFlags), mountErr) } // If an MS_*ATIME flag was requested, it must match the @@ -691,17 +697,19 @@ func mountToRootfs(c *mountConfig, m mountEntry) error { // MS_STRICTATIME mounts even if the user requested MS_RELATIME // or MS_NOATIME. if m.Flags&mntAtimeFlags != 0 && m.Flags&mntAtimeFlags != srcFlags&mntAtimeFlags { - return mountErr + return fmt.Errorf("cannot change locked atime flags %s: %w", stringifyMountFlags(srcFlags&mntAtimeFlags), mountErr) } // Retry the mount with the existing lockable mount flags // applied. flags |= srcFlags & mntLockFlags mountErr = mountViaFds("", nil, m.Destination, dstFd, "", uintptr(flags), "") - logrus.Debugf("remount retry: srcFlags=0x%x flagsSet=0x%x flagsClr=0x%x: %v", srcFlags, m.Flags, m.ClearedFlags, mountErr) + if mountErr != nil { + mountErr = fmt.Errorf("remount with locked flags %s re-applied: %w", stringifyMountFlags(srcFlags&mntLockFlags), mountErr) + } return mountErr }); err != nil { - return err + return fmt.Errorf("failed to set user-requested vfs flags on bind-mount: %w", err) } }