nspawn-mount: Use setns() in wipe_fully_visible_api_fs()

namespace_enter() now does a is_our_namespace() check, which requires
/proc on older kernels, which is not available anymore after we call
do_wipe_fully_visible_api_fs() in wipe_fully_visible_api_fs().

Let's just call setns() instead as namespace_enter() is overkill to
enter a single namespace anyway.
This commit is contained in:
Daan De Meyer
2026-02-17 04:55:24 +01:00
committed by Mike Yuan
parent 710742270b
commit 48c84fe730
+8 -17
View File
@@ -1,6 +1,7 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include <linux/magic.h>
#include <sched.h>
#include <sys/mount.h>
#include <unistd.h>
@@ -1491,7 +1492,7 @@ static int do_wipe_fully_visible_api_fs(void) {
int wipe_fully_visible_api_fs(int mntns_fd) {
_cleanup_close_ int orig_mntns_fd = -EBADF;
int r, rr;
int r;
log_debug("Wiping fully visible API FS");
@@ -1499,23 +1500,13 @@ int wipe_fully_visible_api_fs(int mntns_fd) {
if (orig_mntns_fd < 0)
return log_error_errno(orig_mntns_fd, "Failed to pin originating mount namespace: %m");
r = namespace_enter(/* pidns_fd= */ -EBADF,
mntns_fd,
/* netns_fd= */ -EBADF,
/* userns_fd= */ -EBADF,
/* root_fd= */ -EBADF);
if (r < 0)
return log_error_errno(r, "Failed to enter mount namespace: %m");
if (setns(mntns_fd, CLONE_NEWNS) < 0)
return log_error_errno(errno, "Failed to enter mount namespace: %m");
rr = do_wipe_fully_visible_api_fs();
r = do_wipe_fully_visible_api_fs();
r = namespace_enter(/* pidns_fd= */ -EBADF,
orig_mntns_fd,
/* netns_fd= */ -EBADF,
/* userns_fd= */ -EBADF,
/* root_fd= */ -EBADF);
if (r < 0)
return log_error_errno(r, "Failed to enter original mount namespace: %m");
if (setns(orig_mntns_fd, CLONE_NEWNS) < 0)
return log_error_errno(errno, "Failed to enter original mount namespace: %m");
return rr;
return r;
}