From 273a0c4983ecff9fe53258755b155227afe2938f Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Sat, 18 Nov 2017 14:30:20 +0100 Subject: support_enter_mount_namespace: Unshare with mount --make-rprivate System defaults vary, and a mere unshare (CLONE_NEWNS) (which is part of support_become_root) is no longer sufficient. Reviewed-by: Christian Brauner --- ChangeLog | 7 +++++ support/Makefile | 1 + support/namespace.h | 5 ++++ support/support_enter_mount_namespace.c | 45 +++++++++++++++++++++++++++++++++ 4 files changed, 58 insertions(+) create mode 100644 support/support_enter_mount_namespace.c diff --git a/ChangeLog b/ChangeLog index c58c58cc2c..b244b32801 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2017-11-18 Florian Weimer + + * support/namespace.h (support_enter_mount_namespace): Declare. + * support/support_enter_mount_namespace.c: New file. + * support/Makefile (libsupport-routines): Add + support_enter_mount_namespace. + 2017-11-18 Florian Weimer * support/temp_file.c (support_create_temp_directory): Use diff --git a/support/Makefile b/support/Makefile index f7a878b950..384fecb65a 100644 --- a/support/Makefile +++ b/support/Makefile @@ -42,6 +42,7 @@ libsupport-routines = \ support_capture_subprocess \ support_capture_subprocess_check \ support_chroot \ + support_enter_mount_namespace \ support_enter_network_namespace \ support_format_address_family \ support_format_addrinfo \ diff --git a/support/namespace.h b/support/namespace.h index 9eddb1a0e9..b5e2d1474a 100644 --- a/support/namespace.h +++ b/support/namespace.h @@ -51,6 +51,11 @@ bool support_can_chroot (void); has sufficient privileges. */ bool support_enter_network_namespace (void); +/* Enter a mount namespace and mark / as private (not shared). If + this function returns true, mount operations in this process will + not affect the host system afterwards. */ +bool support_enter_mount_namespace (void); + /* Return true if support_enter_network_namespace managed to enter a UTS namespace. */ bool support_in_uts_namespace (void); diff --git a/support/support_enter_mount_namespace.c b/support/support_enter_mount_namespace.c new file mode 100644 index 0000000000..6140692075 --- /dev/null +++ b/support/support_enter_mount_namespace.c @@ -0,0 +1,45 @@ +/* Enter a mount namespace. + Copyright (C) 2017 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include + +#include +#include +#include + +bool +support_enter_mount_namespace (void) +{ +#ifdef CLONE_NEWNS + if (unshare (CLONE_NEWNS) == 0) + { + /* On some systems, / is marked as MS_SHARED, which means that + mounts within the namespace leak to the rest of the system, + which is not what we want. */ + if (mount ("none", "/", NULL, MS_REC | MS_PRIVATE, NULL) != 0) + { + printf ("warning: making the mount namespace private failed: %m\n"); + return false; + } + return true; + } + else + printf ("warning: unshare (CLONE_NEWNS) failed: %m\n"); +#endif /* CLONE_NEWNS */ + return false; +} -- cgit v1.2.1