From 273a0c4983ecff9fe53258755b155227afe2938f Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Sat, 18 Nov 2017 14:30:20 +0100 Subject: support_enter_mount_namespace: Unshare with mount --make-rprivate System defaults vary, and a mere unshare (CLONE_NEWNS) (which is part of support_become_root) is no longer sufficient. Reviewed-by: Christian Brauner --- support/support_enter_mount_namespace.c | 45 +++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 support/support_enter_mount_namespace.c (limited to 'support/support_enter_mount_namespace.c') diff --git a/support/support_enter_mount_namespace.c b/support/support_enter_mount_namespace.c new file mode 100644 index 0000000000..6140692075 --- /dev/null +++ b/support/support_enter_mount_namespace.c @@ -0,0 +1,45 @@ +/* Enter a mount namespace. + Copyright (C) 2017 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include + +#include +#include +#include + +bool +support_enter_mount_namespace (void) +{ +#ifdef CLONE_NEWNS + if (unshare (CLONE_NEWNS) == 0) + { + /* On some systems, / is marked as MS_SHARED, which means that + mounts within the namespace leak to the rest of the system, + which is not what we want. */ + if (mount ("none", "/", NULL, MS_REC | MS_PRIVATE, NULL) != 0) + { + printf ("warning: making the mount namespace private failed: %m\n"); + return false; + } + return true; + } + else + printf ("warning: unshare (CLONE_NEWNS) failed: %m\n"); +#endif /* CLONE_NEWNS */ + return false; +} -- cgit v1.2.3-65-gdbad