From: Christian Brauner <christian.brauner@ubuntu.com>
Date: Thu, 8 Feb 2018 10:36:41 +0000 (+0100)
Subject: cgfsng: add required remount flags
X-Git-Tag: lxc-2.0.10~345
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5370a9212cd588e67c04a17aec7e48f87ab0694d;p=thirdparty%2Flxc.git

cgfsng: add required remount flags

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9566d6742852c527bf5af38af5cbb878dad75705

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---

diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c
index ead2348cd..b29b0f9e4 100644
--- a/src/lxc/cgroups/cgfsng.c
+++ b/src/lxc/cgroups/cgfsng.c
@@ -1902,7 +1902,7 @@ static int do_secondstage_mounts_if_needed(int type, struct hierarchy *h,
 					   char *controllerpath, char *cgpath,
 					   const char *container_cgroup)
 {
-	int ret;
+	int ret, remount_flags;
 	char *sourcepath;
 	int flags = MS_BIND;
 
@@ -1914,6 +1914,9 @@ static int do_secondstage_mounts_if_needed(int type, struct hierarchy *h,
 			return -1;
 		}
 
+		remount_flags = add_required_remount_flags(controllerpath,
+							   controllerpath,
+							   flags | MS_REMOUNT);
 		ret = mount(controllerpath, controllerpath, "cgroup",
 			    MS_REMOUNT | MS_BIND | MS_RDONLY, NULL);
 		if (ret < 0) {
@@ -1938,13 +1941,15 @@ static int do_secondstage_mounts_if_needed(int type, struct hierarchy *h,
 	INFO("Mounted \"%s\" onto \"%s\"", h->controllers[0], cgpath);
 
 	if (flags & MS_RDONLY) {
-		ret = mount(sourcepath, cgpath, "cgroup",
-			    MS_REMOUNT | flags | MS_RDONLY, NULL);
+		remount_flags = add_required_remount_flags(sourcepath, cgpath,
+							   flags | MS_REMOUNT);
+		ret = mount(sourcepath, cgpath, "cgroup", remount_flags, NULL);
 		if (ret < 0) {
 			SYSERROR("Failed to remount \"%s\" ro", cgpath);
 			free(sourcepath);
 			return -1;
 		}
+		INFO("Remounted %s read-only", cgpath);
 	}
 
 	free(sourcepath);
@@ -1952,7 +1957,8 @@ static int do_secondstage_mounts_if_needed(int type, struct hierarchy *h,
 	return 0;
 }
 
-static int mount_cgroup_cgns_supported(int type, struct hierarchy *h, const char *controllerpath)
+static int cg_mount_in_cgroup_namespace(int type, struct hierarchy *h,
+					const char *controllerpath)
 {
 	 int ret;
 	 char *controllers = NULL;
@@ -2045,7 +2051,7 @@ static bool cgfsng_mount(void *hdata, const char *root, int type)
 			 * will not have CAP_SYS_ADMIN after it has started we
 			 * need to mount the cgroups manually.
 			 */
-			r = mount_cgroup_cgns_supported(type, h, controllerpath);
+			r = cg_mount_in_cgroup_namespace(type, h, controllerpath);
 			free(controllerpath);
 			if (r < 0)
 				goto bad;
diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index dab112b15..640e37095 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -430,7 +430,7 @@ int pin_rootfs(const char *rootfs)
  * NOEXEC etc are honored.
  */
 unsigned long add_required_remount_flags(const char *s, const char *d,
-		unsigned long flags)
+					 unsigned long flags)
 {
 #ifdef HAVE_STATVFS
 	struct statvfs sb;