Function mountFd

libcontainer/mount_linux.go:253–344

mountFd creates a "mount source fd" (either through open_tree(2) or just open(O_PATH)) based on the provided configuration. This function must be called from within the container's mount namespace. In the case of idmapped mount configurations, the returned mount source will be an open_tree(2) file

(nsHandles *userns.Handles, m *configs.Mount)

//
// This helper is only intended to be used by goCreateMountSources.
func mountFd(nsHandles *userns.Handles, m *configs.Mount) (_ *mountSource, retErr error) {
	if !m.IsBind() {
		return nil, errors.New("new mount api: only bind-mounts are supported")
	}
	if nsHandles == nil {
		nsHandles = new(userns.Handles)
		defer nsHandles.Release()
	}

	var mountFile *os.File
	var sourceType mountSourceType
	defer func() {
		if retErr != nil && mountFile != nil {
			mountFile.Close()
		}
	}()

	// Ideally, we would use OPEN_TREE_CLONE for everything, because we can
	// be sure that the file descriptor cannot be used to escape outside of
	// the mount root. Unfortunately, OPEN_TREE_CLONE is far more expensive
	// than open(2) because it requires doing mounts inside a new anonymous
	// mount namespace. So we use open(2) for standard bind-mounts, and
	// OPEN_TREE_CLONE when we need to set mount attributes here.
	//
	// While passing open(2)'d paths from the host rootfs isn't exactly the
	// safest thing in the world, the files will not survive across
	// execve(2) and "runc init" is non-dumpable so it should not be
	// possible for a malicious container process to gain access to the
	// file descriptors. We also don't do any of this for "runc exec",
	// lessening the risk even further.
	if m.IsIDMapped() {
		flags := uint(unix.OPEN_TREE_CLONE | unix.OPEN_TREE_CLOEXEC)
		if m.Flags&unix.MS_REC == unix.MS_REC {
			flags |= unix.AT_RECURSIVE
		}
		fd, err := unix.OpenTree(unix.AT_FDCWD, m.Source, flags)
		if err != nil {
			return nil, &os.PathError{Op: "open_tree(OPEN_TREE_CLONE)", Path: m.Source, Err: err}
		}
		mountFile = os.NewFile(uintptr(fd), m.Source)
		sourceType = mountSourceOpenTree

		// Configure the id mapping.
		var usernsFile *os.File
		if m.IDMapping.UserNSPath == "" {
			usernsFile, err = nsHandles.Get(userns.Mapping{
				UIDMappings: m.IDMapping.UIDMappings,
				GIDMappings: m.IDMapping.GIDMappings,
			})
			if err != nil {
				return nil, fmt.Errorf("failed to create userns for %s id-mapping: %w", m.Source, err)
			}
		} else {
			usernsFile, err = os.Open(m.IDMapping.UserNSPath)
			if err != nil {
				return nil, fmt.Errorf("failed to open existing userns for %s id-mapping: %w", m.Source, err)
			}
		}