mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-12 09:46:25 +08:00
Akihiro Suda
382eba4354
The new mount option "rro" makes the mount point recursively read-only, by calling `mount_setattr(2)` with `MOUNT_ATTR_RDONLY` and `AT_RECURSIVE`. https://man7.org/linux/man-pages/man2/mount_setattr.2.html Requires kernel >= 5.12. The "rro" option string conforms to the proposal in util-linux/util-linux Issue 1501. Fix issue 2823 Similary, this commit also adds the following mount options: - rrw - r[no]{suid,dev,exec,relatime,atime,strictatime,diratime,symfollow} Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
49 lines
1.3 KiB
Go
49 lines
1.3 KiB
Go
package configs
|
|
|
|
import "golang.org/x/sys/unix"
|
|
|
|
const (
|
|
// EXT_COPYUP is a directive to copy up the contents of a directory when
|
|
// a tmpfs is mounted over it.
|
|
EXT_COPYUP = 1 << iota //nolint:golint // ignore "don't use ALL_CAPS" warning
|
|
)
|
|
|
|
type Mount struct {
|
|
// Source path for the mount.
|
|
Source string `json:"source"`
|
|
|
|
// Destination path for the mount inside the container.
|
|
Destination string `json:"destination"`
|
|
|
|
// Device the mount is for.
|
|
Device string `json:"device"`
|
|
|
|
// Mount flags.
|
|
Flags int `json:"flags"`
|
|
|
|
// Propagation Flags
|
|
PropagationFlags []int `json:"propagation_flags"`
|
|
|
|
// Mount data applied to the mount.
|
|
Data string `json:"data"`
|
|
|
|
// Relabel source if set, "z" indicates shared, "Z" indicates unshared.
|
|
Relabel string `json:"relabel"`
|
|
|
|
// RecAttr represents mount properties to be applied recursively (AT_RECURSIVE), see mount_setattr(2).
|
|
RecAttr *unix.MountAttr `json:"rec_attr"`
|
|
|
|
// Extensions are additional flags that are specific to runc.
|
|
Extensions int `json:"extensions"`
|
|
|
|
// Optional Command to be run before Source is mounted.
|
|
PremountCmds []Command `json:"premount_cmds"`
|
|
|
|
// Optional Command to be run after Source is mounted.
|
|
PostmountCmds []Command `json:"postmount_cmds"`
|
|
}
|
|
|
|
func (m *Mount) IsBind() bool {
|
|
return m.Flags&unix.MS_BIND != 0
|
|
}
|