From ca14e7b463101d4b13f7c23dd952ffe056e6a22c Mon Sep 17 00:00:00 2001 From: Antonio Murdaca Date: Mon, 6 Feb 2017 17:53:23 +0100 Subject: [PATCH] libcontainer: rootfs_linux: support overlayfs As the runtime-spec allows it, we want to be able to specify overlayfs mounts with: { "destination": "/etc/pki", "type": "overlay", "source": "overlay", "options": [ "lowerdir=/etc/pki:/home/amurdaca/go/src/github.com/opencontainers/runc/rootfs_fedora/etc/pki" ] }, This patch takes care of allowing overlayfs mounts. Both RO and RW should be supported. Signed-off-by: Antonio Murdaca --- libcontainer/rootfs_linux.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 2472c71d2..9df6f4ab0 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -313,6 +313,19 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel string) error { } } default: + // ensure that the destination of the mount is resolved of symlinks at mount time because + // any previous mounts can invalidate the next mount's destination. + // this can happen when a user specifies mounts within other mounts to cause breakouts or other + // evil stuff to try to escape the container's rootfs. + var err error + if dest, err = symlink.FollowSymlinkInScope(filepath.Join(rootfs, m.Destination), rootfs); err != nil { + return err + } + if err := checkMountDestination(rootfs, dest); err != nil { + return err + } + // update the mount with the correct dest after symlinks are resolved. + m.Destination = dest if err := os.MkdirAll(dest, 0755); err != nil { return err }