From d4f0f9a52bc0c48db3117ac58205e83ad0d82bba Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Sun, 8 Oct 2017 17:38:12 +1100 Subject: [PATCH] specconv: emit an error when using MS_PRIVATE with --no-pivot Due to the semantics of chroot(2) when it comes to mount namespaces, it is not generally safe to use MS_PRIVATE as a mount propgation when using chroot(2). The reason for this is that this effectively results in a set of mount references being held by the chroot'd namespace which the namespace cannot free. pivot_root(2) does not have this issue because the @old_root can be unmounted by the process. Ultimately, --no-pivot is not really necessary anymore as a commonly used option since f8e6b5af5e12 ("rootfs: make pivot_root not use a temporary directory") resolved the read-only issue. But if someone really needs to use it, MS_PRIVATE is never a good idea. Signed-off-by: Aleksa Sarai --- libcontainer/specconv/spec_linux.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go index 9a17d1e7a..fd8e92fa5 100644 --- a/libcontainer/specconv/spec_linux.go +++ b/libcontainer/specconv/spec_linux.go @@ -203,6 +203,9 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) { if config.RootPropagation, exists = mountPropagationMapping[spec.Linux.RootfsPropagation]; !exists { return nil, fmt.Errorf("rootfsPropagation=%v is not supported", spec.Linux.RootfsPropagation) } + if config.NoPivotRoot && (config.RootPropagation&unix.MS_PRIVATE != 0) { + return nil, fmt.Errorf("rootfsPropagation of [r]private is not safe without pivot_root") + } for _, ns := range spec.Linux.Namespaces { t, exists := namespaceMapping[ns.Type]