mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
forkexec: ensure bind mount preserve the mount flag from source (#17)
This commit is contained in:
parent
63db3b54e6
commit
0baa3107cb
@ -261,9 +261,18 @@ func forkAndExecInChild(r *Runner, argv0 *byte, argv, env []*byte, workdir, host
|
||||
}
|
||||
// bind mount is not respect ro flag so that read-only bind mount needs remount
|
||||
if m.Flags&bindRo == bindRo {
|
||||
// Ensure the flag retains for bind mount
|
||||
const mask = syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_NOEXEC | syscall.MS_NOATIME | syscall.MS_NODIRATIME | syscall.MS_RELATIME
|
||||
var s syscall.Statfs_t
|
||||
_, _, err1 = syscall.RawSyscall(syscall.SYS_STATFS, uintptr(unsafe.Pointer(m.Source)), uintptr(unsafe.Pointer(&s)), 0)
|
||||
if err1 != 0 {
|
||||
childExitErrorWithIndex(pipe, LocMount, i, err1)
|
||||
}
|
||||
|
||||
flag := m.Flags | syscall.MS_REMOUNT | uintptr(s.Flags&mask)
|
||||
_, _, err1 = syscall.RawSyscall6(syscall.SYS_MOUNT, uintptr(unsafe.Pointer(&empty[0])),
|
||||
uintptr(unsafe.Pointer(m.Target)), uintptr(unsafe.Pointer(m.FsType)),
|
||||
uintptr(m.Flags|syscall.MS_REMOUNT), uintptr(unsafe.Pointer(m.Data)), 0)
|
||||
uintptr(flag), uintptr(unsafe.Pointer(m.Data)), 0)
|
||||
if err1 != 0 {
|
||||
childExitErrorWithIndex(pipe, LocMount, i, err1)
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user