Merge pull request #34256 from YHNdnzj/pid1-followup
core: follow-ups for recent PRs
This commit is contained in:
+5
-19
@@ -2641,23 +2641,9 @@ static int compile_bind_mounts(
|
||||
return -ENOMEM;
|
||||
|
||||
FOREACH_ARRAY(item, context->bind_mounts, context->n_bind_mounts) {
|
||||
_cleanup_free_ char *s = NULL, *d = NULL;
|
||||
|
||||
s = strdup(item->source);
|
||||
if (!s)
|
||||
return -ENOMEM;
|
||||
|
||||
d = strdup(item->destination);
|
||||
if (!d)
|
||||
return -ENOMEM;
|
||||
|
||||
bind_mounts[h++] = (BindMount) {
|
||||
.source = TAKE_PTR(s),
|
||||
.destination = TAKE_PTR(d),
|
||||
.read_only = item->read_only,
|
||||
.recursive = item->recursive,
|
||||
.ignore_enoent = item->ignore_enoent,
|
||||
};
|
||||
r = bind_mount_add(&bind_mounts, &h, item);
|
||||
if (r < 0)
|
||||
return r;
|
||||
}
|
||||
|
||||
for (ExecDirectoryType t = 0; t < _EXEC_DIRECTORY_TYPE_MAX; t++) {
|
||||
@@ -3235,7 +3221,7 @@ static int apply_mount_namespace(
|
||||
.private_tmp = needs_sandboxing ? context->private_tmp : false,
|
||||
|
||||
.mount_apivfs = needs_sandboxing && exec_context_get_effective_mount_apivfs(context),
|
||||
.bind_journal_sockets = needs_sandboxing && exec_context_get_effective_bind_journal_sockets(context),
|
||||
.bind_log_sockets = needs_sandboxing && exec_context_get_effective_bind_log_sockets(context),
|
||||
|
||||
/* If NNP is on, we can turn on MS_NOSUID, since it won't have any effect anymore. */
|
||||
.mount_nosuid = needs_sandboxing && context->no_new_privileges && !mac_selinux_use(),
|
||||
@@ -3857,7 +3843,7 @@ static bool exec_context_need_unprivileged_private_users(
|
||||
context->ipc_namespace_path ||
|
||||
context->private_mounts > 0 ||
|
||||
context->mount_apivfs > 0 ||
|
||||
context->bind_journal_sockets > 0 ||
|
||||
context->bind_log_sockets > 0 ||
|
||||
context->n_bind_mounts > 0 ||
|
||||
context->n_temporary_filesystems > 0 ||
|
||||
context->root_directory ||
|
||||
|
||||
Reference in New Issue
Block a user