mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

libct: minor refactor in mountToRootfs

Browse Source 
No change in functionality, just a preparation for the next patch.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2026-03-20 14:29:23 -07:00
parent 60352524d3
commit 78b80677f6
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/rootfs_linux.go
+8 -8
View File
@@ -582,7 +582,6 @@ func (m *mountEntry) createOpenMountpoint(rootfs string) (Err error) {
} }
func mountToRootfs(c *mountConfig, m mountEntry) error { func mountToRootfs(c *mountConfig, m mountEntry) error {
rootfs := c.root
defer func() { defer func() {
if m.dstFile != nil { if m.dstFile != nil {
_ = m.dstFile.Close() _ = m.dstFile.Close()
@@ -599,6 +598,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
// has been a "fun" attack scenario in the past. // has been a "fun" attack scenario in the past.
// TODO: This won't be necessary once we switch to libpathrs and we can // TODO: This won't be necessary once we switch to libpathrs and we can
// stop all of these symlink-exchange attacks. // stop all of these symlink-exchange attacks.
rootfs := c.root
dest := filepath.Clean(m.Destination) dest := filepath.Clean(m.Destination)
if !pathrs.IsLexicallyInRoot(rootfs, dest) { if !pathrs.IsLexicallyInRoot(rootfs, dest) {
// Do not use securejoin as it resolves symlinks. // Do not use securejoin as it resolves symlinks.
@@ -614,7 +614,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
} else if !fi.IsDir() { } else if !fi.IsDir() {
return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device) return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device)
} }
dstFile, err := pathrs.MkdirAllInRoot(rootfs, dest, 0o755) dstFile, err := pathrs.MkdirAllInRoot(c.root, dest, 0o755)
if err != nil { if err != nil {
return err return err
} }
@@ -622,17 +622,17 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
// "proc" and "sys" mounts need special handling (without resolving the // "proc" and "sys" mounts need special handling (without resolving the
// destination) to avoid attacks. // destination) to avoid attacks.
m.dstFile = dstFile m.dstFile = dstFile
return m.mountPropagate(rootfs, "") return m.mountPropagate(c.root, "")
} }
mountLabel := c.label mountLabel := c.label
if err := m.createOpenMountpoint(rootfs); err != nil { if err := m.createOpenMountpoint(c.root); err != nil {
return fmt.Errorf("create mountpoint for %s mount: %w", m.Destination, err) return fmt.Errorf("create mountpoint for %s mount: %w", m.Destination, err)
} }
switch m.Device { switch m.Device {
case "mqueue": case "mqueue":
if err := m.mountPropagate(rootfs, ""); err != nil { if err := m.mountPropagate(c.root, ""); err != nil {
return err return err
} }
return utils.WithProcfdFile(m.dstFile, func(dstFd string) error { return utils.WithProcfdFile(m.dstFile, func(dstFd string) error {
@@ -643,12 +643,12 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
if m.Extensions&configs.EXT_COPYUP == configs.EXT_COPYUP { if m.Extensions&configs.EXT_COPYUP == configs.EXT_COPYUP {
err = doTmpfsCopyUp(m, mountLabel) err = doTmpfsCopyUp(m, mountLabel)
} else { } else {
err = m.mountPropagate(rootfs, mountLabel) err = m.mountPropagate(c.root, mountLabel)
} }
return err return err
case "bind": case "bind":
// open_tree()-related shenanigans are all handled in mountViaFds. // open_tree()-related shenanigans are all handled in mountViaFds.
if err := m.mountPropagate(rootfs, mountLabel); err != nil { if err := m.mountPropagate(c.root, mountLabel); err != nil {
return err return err
} }
@@ -760,7 +760,7 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
} }
return mountCgroupV1(m, c) return mountCgroupV1(m, c)
default: default:
return m.mountPropagate(rootfs, mountLabel) return m.mountPropagate(c.root, mountLabel)
} }
} }