From: David Ward Date: Wed, 27 Mar 2013 01:27:52 +0000 (-0400) Subject: Set all mounts to MS_SLAVE when starting a container without a rootfs X-Git-Tag: lxc-0.9.0~1^2~10 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a0f379bfec4e341763ba7ed0099ce9cabaccd7c5;p=thirdparty%2Flxc.git Set all mounts to MS_SLAVE when starting a container without a rootfs If the filesystem mounts on the host have the MS_SHARED or MS_SLAVE flag set, and a container without a rootfs is started, then any new mounts created inside the container are currently propagated into the host. In addition to mounts placed in the configuration file of the container or performed manually after startup, the automatic mounting of /proc by lxc-execute will propagate back into the host, effectively crippling the entire system. This can be prevented by setting the MS_SLAVE flag on all mounts (inside the container's own mount namespace) during startup if a rootfs is not configured. Signed-off-by: David Ward Acked-by: Serge E. Hallyn --- diff --git a/src/lxc/conf.c b/src/lxc/conf.c index 965a0d2ea..6b3f31813 100644 --- a/src/lxc/conf.c +++ b/src/lxc/conf.c @@ -1129,8 +1129,13 @@ static int setup_rootfs(struct lxc_conf *conf) { const struct lxc_rootfs *rootfs = &conf->rootfs; - if (!rootfs->path) + if (!rootfs->path) { + if (mount("", "/", NULL, MS_SLAVE|MS_REC, 0)) { + SYSERROR("Failed to make / rslave"); + return -1; + } return 0; + } if (access(rootfs->mount, F_OK)) { SYSERROR("failed to access to '%s', check it is present",