From fb4c27c4b79c7da0ee0ada3a39ae0abc85cb1316 Mon Sep 17 00:00:00 2001
From: Eduardo Vega <edvegavalerio@gmail.com>
Date: Fri, 28 Aug 2020 16:06:23 -0600
Subject: [PATCH] Fix mount error when chmod RO tmpfs

Signed-off-by: Eduardo Vega <edvegavalerio@gmail.com>
---
 libcontainer/rootfs_linux.go  | 12 ++++++++++++
 tests/integration/mounts.bats |  9 +++++++++
 2 files changed, 21 insertions(+)

diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index dd52713da..aa1161874 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -383,6 +383,12 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string, enableCgroupns b
 				return err
 			}
 		}
+		// Initially mounted rw in mountPropagate, remount to ro if flag set.
+		if m.Flags&unix.MS_RDONLY != 0 {
+			if err := remount(m, rootfs); err != nil {
+				return err
+			}
+		}
 		return nil
 	case "bind":
 		if err := prepareBindMount(m, rootfs); err != nil {
@@ -957,6 +963,12 @@ func mountPropagate(m *configs.Mount, rootfs string, mountLabel string) error {
 		flags &= ^unix.MS_RDONLY
 	}
 
+	// Mount it rw to allow chmod operation. A remount will be performed
+	// later to make it ro if set.
+	if m.Device == "tmpfs" {
+		flags &= ^unix.MS_RDONLY
+	}
+
 	copyUp := m.Extensions&configs.EXT_COPYUP == configs.EXT_COPYUP
 	if !(copyUp || strings.HasPrefix(dest, rootfs)) {
 		dest = filepath.Join(rootfs, dest)
diff --git a/tests/integration/mounts.bats b/tests/integration/mounts.bats
index 1e1b8f0d1..6a73962c7 100644
--- a/tests/integration/mounts.bats
+++ b/tests/integration/mounts.bats
@@ -20,3 +20,12 @@ function teardown() {
 	[ "$status" -eq 0 ]
 	[[ "${lines[0]}" == *'/tmp/bind/config.json'* ]]
 }
+
+@test "runc run [ro tmpfs mount]" {
+	update_config 	' .mounts += [{"source": "tmpfs", "destination": "/mnt", "type": "tmpfs", "options": ["ro", "nodev", "nosuid", "mode=755"]}] 
+			| .process.args |= ["grep", "^tmpfs /mnt", "/proc/mounts"]' 
+
+	runc run test_ro_tmpfs_mount
+	[ "$status" -eq 0 ]
+	[[ "${lines[0]}" == *'ro,'* ]]
+}