Function getUnprivilegedMountFlags

core/mount/mount_linux.go:225–250

Get the set of mount flags that are set on the mount that contains the given path and are locked by CL_UNPRIVILEGED. From https://github.com/moby/moby/blob/v23.0.1/daemon/oci_linux.go#L430-L460

(path string)

//
// From https://github.com/moby/moby/blob/v23.0.1/daemon/oci_linux.go#L430-L460
func getUnprivilegedMountFlags(path string) (int, error) {
	var statfs unix.Statfs_t
	if err := unix.Statfs(path, &statfs); err != nil {
		return 0, err
	}

	// The set of keys come from https://github.com/torvalds/linux/blob/v4.13/fs/namespace.c#L1034-L1048.
	unprivilegedFlags := []int{
		unix.MS_RDONLY,
		unix.MS_NODEV,
		unix.MS_NOEXEC,
		unix.MS_NOSUID,
		unix.MS_NOATIME,
		unix.MS_RELATIME,
		unix.MS_NODIRATIME,
	}

	var flags int
	for _, flag := range unprivilegedFlags {
		if int(statfs.Flags)&flag == flag {
			flags |= flag
		}
	}

	return flags, nil
}

func doPrepareIDMappedOverlay(tmpDir string, lowerDirs []string, usernsFd int) (_ []string, _ func(), retErr error) {
	commonDir, err := getCommonDirectory(lowerDirs)