From patchwork Sat Nov 18 00:23:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Brauner X-Patchwork-Id: 24342 Received: (qmail 80707 invoked by alias); 18 Nov 2017 00:23:20 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 80696 invoked by uid 89); 18 Nov 2017 00:23:19 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-26.5 required=5.0 tests=AWL, BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_SHORT, KB_WAM_FROM_NAME_SINGLEWORD, RCVD_IN_DNSWL_LOW, RP_MATCHES_RCVD, SPF_PASS autolearn=ham version=3.3.2 spammy=peer X-HELO: mx2.mailbox.org Date: Sat, 18 Nov 2017 01:23:11 +0100 From: Christian Brauner To: Florian Weimer Cc: Luke Shumaker , Christian Brauner , GNU C Library Subject: Re: [PATCH] support_enter_mount_namespace: Unshare with mount --make-rprivate Message-ID: <20171118002311.nmvyhl6uyf323rzk@mailbox.org> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: System defaults vary, and a mere unshare (CLONE_NEWNS) (which is part of support_become_root) is no longer sufficient. 2017-11-17 Florian Weimer * support/namespace.h (support_enter_mount_namespace): Declare. * support/support_enter_mount_namespace.c: New file. * support/Makefile (libsupport-routines): Add support_enter_mount_namespace. Reviewed-by: Christian Brauner + else + printf ("warning: unshare (CLONE_NEWNS) failed: %m\n"); +#endif /* CLONE_NEWNS */ + return false; +} diff --git a/support/Makefile b/support/Makefile index f7a878b950..384fecb65a 100644 --- a/support/Makefile +++ b/support/Makefile @@ -42,6 +42,7 @@ libsupport-routines = \ support_capture_subprocess \ support_capture_subprocess_check \ support_chroot \ + support_enter_mount_namespace \ support_enter_network_namespace \ support_format_address_family \ support_format_addrinfo \ diff --git a/support/namespace.h b/support/namespace.h index 9eddb1a0e9..b5e2d1474a 100644 --- a/support/namespace.h +++ b/support/namespace.h @@ -51,6 +51,11 @@ bool support_can_chroot (void); has sufficient privileges. */ bool support_enter_network_namespace (void); +/* Enter a mount namespace and mark / as private (not shared). If + this function returns true, mount operations in this process will + not affect the host system afterwards. */ +bool support_enter_mount_namespace (void); + /* Return true if support_enter_network_namespace managed to enter a UTS namespace. */ bool support_in_uts_namespace (void); diff --git a/support/support_enter_mount_namespace.c b/support/support_enter_mount_namespace.c new file mode 100644 index 0000000000..6140692075 --- /dev/null +++ b/support/support_enter_mount_namespace.c @@ -0,0 +1,45 @@ +/* Enter a mount namespace. + Copyright (C) 2017 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include + +#include +#include +#include + +bool +support_enter_mount_namespace (void) +{ +#ifdef CLONE_NEWNS + if (unshare (CLONE_NEWNS) == 0) + { + /* On some systems, / is marked as MS_SHARED, which means that + mounts within the namespace leak to the rest of the system, + which is not what we want. */ + if (mount ("none", "/", NULL, MS_REC | MS_PRIVATE, NULL) != 0) + { Right, this I remember we need to do something similar because systemd mounts / MS_SHARED although we use MS_REC | MS_SLAVE but since you likely don't care about propagation into the peer here this is fine. + printf ("warning: making the mount namespace private failed: %m\n"); + return false; + } + return true; + }