From 1583dfda7c4e5ad71efe0615c06e5676528d8203 Mon Sep 17 00:00:00 2001 From: Gao feng Date: Thu, 5 Sep 2013 11:50:40 +0100 Subject: [PATCH] LXC: Don't mount securityfs when user namespace enabled Right now, securityfs is disallowed to be mounted in non-initial user namespace, so we must avoid trying to mount securityfs in a container which has user namespace enabled. Signed-off-by: Gao feng --- src/lxc/lxc_container.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 8abaea0f32..c41ab40503 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -750,7 +750,7 @@ err: } -static int lxcContainerMountBasicFS(void) +static int lxcContainerMountBasicFS(bool userns_enabled) { const struct { const char *src; @@ -801,6 +801,9 @@ static int lxcContainerMountBasicFS(void) continue; #endif + if (STREQ(mnts[i].src, "securityfs") && userns_enabled) + continue; + if (virFileMakePath(mnts[i].dst) < 0) { virReportSystemError(errno, _("Failed to mkdir %s"), @@ -1530,7 +1533,7 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef, goto cleanup; /* Mounts the core /proc, /sys, etc filesystems */ - if (lxcContainerMountBasicFS() < 0) + if (lxcContainerMountBasicFS(vmDef->idmap.nuidmap) < 0) goto cleanup; /* Mounts /proc/meminfo etc sysinfo */ -- GitLab