mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

nsexec: remove cgroupns special-casing

Browse Source 
The original implementation of cgroupns had additional synchronisation
to "ensure" that the process is in the correct cgroup before unsharing
the cgroupns. This behaviour was actually never necessary, and after
commit 5110bd2fc0 ("nsenter: remove cgroupns sync mechanism") there is
no synchronisation at all, meaning that CLONE_NEWCGROUP should not get
any special treatment.

Fixes: 5110bd2fc0 ("nsenter: remove cgroupns sync mechanism")
Fixes: df3fa115f9 ("Add support for cgroup namespace")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
This commit is contained in:
Aleksa Sarai
2023-08-01 20:30:53 +10:00
committed by Kir Kolyshkin
parent 5c7839b503
commit 8aa97ad3a3
1 changed files with 1 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/nsenter/nsexec.c
+1 -5
View File
@@ -1171,7 +1171,7 @@ void nsexec(void)
* some old kernel versions where clone(CLONE_PARENT | CLONE_NEWPID)
* was broken, so we'll just do it the long way anyway.
*/
try_unshare(config.cloneflags & ~CLONE_NEWCGROUP, "remaining namespaces (except cgroupns)");
try_unshare(config.cloneflags, "remaining namespaces");
update_timens_offsets(config.timensoffset, config.timensoffset_len);
/* Ask our parent to send the mount sources fds. */
@@ -1302,10 +1302,6 @@ void nsexec(void)
bail("setgroups failed");
}
if (config.cloneflags & CLONE_NEWCGROUP) {
try_unshare(CLONE_NEWCGROUP, "cgroup namespace");
}
write_log(DEBUG, "signal completion to stage-0");
s = SYNC_CHILD_FINISH;
if (write(syncfd, &s, sizeof(s)) != sizeof(s))