mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 02:25:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

linux.rs: Don't pivot_root when using host's root directory

Browse source 
pivot_root(2) will fail with EBUSY if we try to pivot_root to "/".
Check for this case and skip the pivot_root if necessary.

BUG=b:147258662
TEST=`tast run <dut> vm.Virtiofs`

Change-Id: I1d7645844e183222a561578677fc5f59c080d58c
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2067823
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
This commit is contained in:
Chirantan Ekbote 2020-02-21 16:37:27 +09:00 committed by Commit Bot
parent d8144a56e2
commit f84c2298e9
1 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/linux.rs
View file

@ -335,9 +335,13 @@ fn create_base_minijail(
if let Some(gid_map) = config.gid_map { if let Some(gid_map) = config.gid_map {
j.gidmap(gid_map).map_err(Error::SettingGidMap)?; j.gidmap(gid_map).map_err(Error::SettingGidMap)?;
} }
// Run in a new mount namespace.
j.namespace_vfs();
// Run in an empty network namespace. // Run in an empty network namespace.
j.namespace_net(); j.namespace_net();
// Apply the block device seccomp policy.
// Don't allow the device to gain new privileges.
j.no_new_privs(); j.no_new_privs();
// By default we'll prioritize using the pre-compiled .bpf over the .policy // By default we'll prioritize using the pre-compiled .bpf over the .policy
@ -367,9 +371,12 @@ fn create_base_minijail(
j.run_as_init(); j.run_as_init();
} }
// Create a new mount namespace with an empty root FS. // Only pivot_root if we are not re-using the current root directory.
j.namespace_vfs(); if root != Path::new("/") {
j.enter_pivot_root(root).map_err(Error::DevicePivotRoot)?; // It's safe to call `namespace_vfs` multiple times.
j.namespace_vfs();
j.enter_pivot_root(root).map_err(Error::DevicePivotRoot)?;
}
// Most devices don't need to open many fds. // Most devices don't need to open many fds.
let limit = if let Some(r) = r_limit { r } else { 1024u64 }; let limit = if let Some(r) = r_limit { r } else { 1024u64 };