forked from lix-project/lix
Simplify remouting with MS_PRIVATE in sandbox build
also fix race condition if mounts are added after mountinfo is read.
This commit is contained in:
parent
7ee43df862
commit
855abd85d8
|
@ -2283,12 +2283,8 @@ void DerivationGoal::runChild()
|
||||||
outside of the namespace. Making a subtree private is
|
outside of the namespace. Making a subtree private is
|
||||||
local to the namespace, though, so setting MS_PRIVATE
|
local to the namespace, though, so setting MS_PRIVATE
|
||||||
does not affect the outside world. */
|
does not affect the outside world. */
|
||||||
Strings mounts = tokenizeString<Strings>(readFile("/proc/self/mountinfo", true), "\n");
|
if (mount(0, "/", 0, MS_REC|MS_PRIVATE, 0) == -1) {
|
||||||
for (auto & i : mounts) {
|
throw SysError("unable to make ‘/’ private mount");
|
||||||
vector<string> fields = tokenizeString<vector<string> >(i, " ");
|
|
||||||
string fs = decodeOctalEscaped(fields.at(4));
|
|
||||||
if (mount(0, fs.c_str(), 0, MS_PRIVATE, 0) == -1)
|
|
||||||
throw SysError(format("unable to make filesystem ‘%1%’ private") % fs);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Bind-mount chroot directory to itself, to treat it as a
|
/* Bind-mount chroot directory to itself, to treat it as a
|
||||||
|
|
Loading…
Reference in a new issue