diff --git a/pkg/forkexec/fork_child_linux.go b/pkg/forkexec/fork_child_linux.go index a15fdf3..8a53a31 100644 --- a/pkg/forkexec/fork_child_linux.go +++ b/pkg/forkexec/fork_child_linux.go @@ -261,9 +261,18 @@ func forkAndExecInChild(r *Runner, argv0 *byte, argv, env []*byte, workdir, host } // bind mount is not respect ro flag so that read-only bind mount needs remount if m.Flags&bindRo == bindRo { + // Ensure the flag retains for bind mount + const mask = syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_NOEXEC | syscall.MS_NOATIME | syscall.MS_NODIRATIME | syscall.MS_RELATIME + var s syscall.Statfs_t + _, _, err1 = syscall.RawSyscall(syscall.SYS_STATFS, uintptr(unsafe.Pointer(m.Source)), uintptr(unsafe.Pointer(&s)), 0) + if err1 != 0 { + childExitErrorWithIndex(pipe, LocMount, i, err1) + } + + flag := m.Flags | syscall.MS_REMOUNT | uintptr(s.Flags&mask) _, _, err1 = syscall.RawSyscall6(syscall.SYS_MOUNT, uintptr(unsafe.Pointer(&empty[0])), uintptr(unsafe.Pointer(m.Target)), uintptr(unsafe.Pointer(m.FsType)), - uintptr(m.Flags|syscall.MS_REMOUNT), uintptr(unsafe.Pointer(m.Data)), 0) + uintptr(flag), uintptr(unsafe.Pointer(m.Data)), 0) if err1 != 0 { childExitErrorWithIndex(pipe, LocMount, i, err1) }