forkexec: ensure bind mount preserve the mount flag from source (#17)

This commit is contained in:
tobiichi3227 2025-10-12 04:11:06 +08:00 committed by GitHub
parent 63db3b54e6
commit 0baa3107cb
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -261,9 +261,18 @@ func forkAndExecInChild(r *Runner, argv0 *byte, argv, env []*byte, workdir, host
} }
// bind mount is not respect ro flag so that read-only bind mount needs remount // bind mount is not respect ro flag so that read-only bind mount needs remount
if m.Flags&bindRo == bindRo { if m.Flags&bindRo == bindRo {
// Ensure the flag retains for bind mount
const mask = syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_NOEXEC | syscall.MS_NOATIME | syscall.MS_NODIRATIME | syscall.MS_RELATIME
var s syscall.Statfs_t
_, _, err1 = syscall.RawSyscall(syscall.SYS_STATFS, uintptr(unsafe.Pointer(m.Source)), uintptr(unsafe.Pointer(&s)), 0)
if err1 != 0 {
childExitErrorWithIndex(pipe, LocMount, i, err1)
}
flag := m.Flags | syscall.MS_REMOUNT | uintptr(s.Flags&mask)
_, _, err1 = syscall.RawSyscall6(syscall.SYS_MOUNT, uintptr(unsafe.Pointer(&empty[0])), _, _, err1 = syscall.RawSyscall6(syscall.SYS_MOUNT, uintptr(unsafe.Pointer(&empty[0])),
uintptr(unsafe.Pointer(m.Target)), uintptr(unsafe.Pointer(m.FsType)), uintptr(unsafe.Pointer(m.Target)), uintptr(unsafe.Pointer(m.FsType)),
uintptr(m.Flags|syscall.MS_REMOUNT), uintptr(unsafe.Pointer(m.Data)), 0) uintptr(flag), uintptr(unsafe.Pointer(m.Data)), 0)
if err1 != 0 { if err1 != 0 {
childExitErrorWithIndex(pipe, LocMount, i, err1) childExitErrorWithIndex(pipe, LocMount, i, err1)
} }