mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
forkexec: ensure bind mount preserve the mount flag from source (#17)
This commit is contained in:
parent
63db3b54e6
commit
0baa3107cb
@ -261,9 +261,18 @@ func forkAndExecInChild(r *Runner, argv0 *byte, argv, env []*byte, workdir, host
|
|||||||
}
|
}
|
||||||
// bind mount is not respect ro flag so that read-only bind mount needs remount
|
// bind mount is not respect ro flag so that read-only bind mount needs remount
|
||||||
if m.Flags&bindRo == bindRo {
|
if m.Flags&bindRo == bindRo {
|
||||||
|
// Ensure the flag retains for bind mount
|
||||||
|
const mask = syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_NOEXEC | syscall.MS_NOATIME | syscall.MS_NODIRATIME | syscall.MS_RELATIME
|
||||||
|
var s syscall.Statfs_t
|
||||||
|
_, _, err1 = syscall.RawSyscall(syscall.SYS_STATFS, uintptr(unsafe.Pointer(m.Source)), uintptr(unsafe.Pointer(&s)), 0)
|
||||||
|
if err1 != 0 {
|
||||||
|
childExitErrorWithIndex(pipe, LocMount, i, err1)
|
||||||
|
}
|
||||||
|
|
||||||
|
flag := m.Flags | syscall.MS_REMOUNT | uintptr(s.Flags&mask)
|
||||||
_, _, err1 = syscall.RawSyscall6(syscall.SYS_MOUNT, uintptr(unsafe.Pointer(&empty[0])),
|
_, _, err1 = syscall.RawSyscall6(syscall.SYS_MOUNT, uintptr(unsafe.Pointer(&empty[0])),
|
||||||
uintptr(unsafe.Pointer(m.Target)), uintptr(unsafe.Pointer(m.FsType)),
|
uintptr(unsafe.Pointer(m.Target)), uintptr(unsafe.Pointer(m.FsType)),
|
||||||
uintptr(m.Flags|syscall.MS_REMOUNT), uintptr(unsafe.Pointer(m.Data)), 0)
|
uintptr(flag), uintptr(unsafe.Pointer(m.Data)), 0)
|
||||||
if err1 != 0 {
|
if err1 != 0 {
|
||||||
childExitErrorWithIndex(pipe, LocMount, i, err1)
|
childExitErrorWithIndex(pipe, LocMount, i, err1)
|
||||||
}
|
}
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user