SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: ReadWritePaths= and friends assume '+' prefix when BindPaths= or freinds are set

Browse Source 
When at least one of BindPaths=, BindReadOnlyPaths=, RootImage=,
RuntimeDirectory= or their friends are set, systemd prepares
a namespace under /run/systemd/unit-root. Thus, ReadWritePaths=
or their friends without '+' prefix is completely meaningless.
So, let's assume '+' prefix when one of them are set.

Fixes #7070 and #7080.
This commit is contained in:
Yu Watanabe
2017-11-08 15:48:01 +09:00
parent 7bcef4efe6
commit d18aff0422
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/namespace.c
+7 -5
View File
@@ -191,7 +191,7 @@ static void mount_entry_done(MountEntry *p) {
p->source_malloc = mfree(p->source_malloc);
}
static int append_access_mounts(MountEntry **p, char **strv, MountMode mode) {
static int append_access_mounts(MountEntry **p, char **strv, MountMode mode, bool forcibly_require_prefix) {
char **i;
assert(p);
@@ -219,7 +219,7 @@ static int append_access_mounts(MountEntry **p, char **strv, MountMode mode) {
.path_const = e,
.mode = mode,
.ignore = ignore,
.has_prefix = !needs_prefix,
.has_prefix = !needs_prefix && !forcibly_require_prefix,
};
}
@@ -983,6 +983,7 @@ int setup_namespace(
bool make_slave = false;
const char *root;
unsigned n_mounts;
bool require_prefix = false;
int r = 0;
assert(ns_info);
@@ -1027,6 +1028,7 @@ int setup_namespace(
root = "/run/systemd/unit-root";
(void) mkdir_label(root, 0700);
require_prefix = true;
} else
root = NULL;
@@ -1047,15 +1049,15 @@ int setup_namespace(
if (n_mounts > 0) {
m = mounts = (MountEntry *) alloca0(n_mounts * sizeof(MountEntry));
r = append_access_mounts(&m, read_write_paths, READWRITE);
r = append_access_mounts(&m, read_write_paths, READWRITE, require_prefix);
if (r < 0)
goto finish;
r = append_access_mounts(&m, read_only_paths, READONLY);
r = append_access_mounts(&m, read_only_paths, READONLY, require_prefix);
if (r < 0)
goto finish;
r = append_access_mounts(&m, inaccessible_paths, INACCESSIBLE);
r = append_access_mounts(&m, inaccessible_paths, INACCESSIBLE, require_prefix);
if (r < 0)
goto finish;