From 855abd85d8ec27411aa4ad3be2b7f90d17b5693d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Fri, 25 Nov 2016 00:08:34 +0100 Subject: [PATCH] Simplify remouting with MS_PRIVATE in sandbox build also fix race condition if mounts are added after mountinfo is read. --- src/libstore/build.cc | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/src/libstore/build.cc b/src/libstore/build.cc index ba51f8591..ee266b7d3 100644 --- a/src/libstore/build.cc +++ b/src/libstore/build.cc @@ -2283,12 +2283,8 @@ void DerivationGoal::runChild() outside of the namespace. Making a subtree private is local to the namespace, though, so setting MS_PRIVATE does not affect the outside world. */ - Strings mounts = tokenizeString(readFile("/proc/self/mountinfo", true), "\n"); - for (auto & i : mounts) { - vector fields = tokenizeString >(i, " "); - string fs = decodeOctalEscaped(fields.at(4)); - if (mount(0, fs.c_str(), 0, MS_PRIVATE, 0) == -1) - throw SysError(format("unable to make filesystem ‘%1%’ private") % fs); + if (mount(0, "/", 0, MS_REC|MS_PRIVATE, 0) == -1) { + throw SysError("unable to make ‘/’ private mount"); } /* Bind-mount chroot directory to itself, to treat it as a