Do the mount operation followed by additional mounts required to take care of propagation flags. This will always be scoped inside the container rootfs.
(rootFd *os.File, mountLabel string)
| 1470 | // Do the mount operation followed by additional mounts required to take care |
| 1471 | // of propagation flags. This will always be scoped inside the container rootfs. |
| 1472 | func (m *mountEntry) mountPropagate(rootFd *os.File, mountLabel string) error { |
| 1473 | var ( |
| 1474 | data = label.FormatMountLabel(m.Data, mountLabel) |
| 1475 | flags = m.Flags |
| 1476 | ) |
| 1477 | // Delay mounting the filesystem read-only if we need to do further |
| 1478 | // operations on it. We need to set up files in "/dev", and other tmpfs |
| 1479 | // mounts may need to be chmod-ed after mounting. These mounts will be |
| 1480 | // remounted ro later in finalizeRootfs(), if necessary. |
| 1481 | if m.Device == "tmpfs" || pathrs.LexicallyCleanPath(m.Destination) == "/dev" { |
| 1482 | flags &= ^unix.MS_RDONLY |
| 1483 | } |
| 1484 | |
| 1485 | if err := utils.WithProcfdFile(m.dstFile, func(dstFd string) error { |
| 1486 | return mountViaFds(m.Source, m.srcFile, m.Destination, dstFd, m.Device, uintptr(flags), data) |
| 1487 | }); err != nil { |
| 1488 | return err |
| 1489 | } |
| 1490 | |
| 1491 | // We need to re-open the mountpoint after doing the mount, in order for us |
| 1492 | // to operate on the new mount we just created. However, we cannot use |
| 1493 | // pathrs.Reopen because we need to re-resolve from the parent directory to |
| 1494 | // get a new handle to the top mount. |
| 1495 | // |
| 1496 | // TODO: Use move_mount(2) on newer kernels so that this is no longer |
| 1497 | // necessary on modern systems. |
| 1498 | newDstFile, err := reopenAfterMount(rootFd, m.dstFile, unix.O_PATH) |
| 1499 | if err != nil { |
| 1500 | return fmt.Errorf("reopen mountpoint after mount: %w", err) |
| 1501 | } |
| 1502 | _ = m.dstFile.Close() |
| 1503 | m.dstFile = newDstFile |
| 1504 | |
| 1505 | // Apply the propagation flags on the new mount. |
| 1506 | if err := utils.WithProcfdFile(m.dstFile, func(dstFd string) error { |
| 1507 | for _, pflag := range m.PropagationFlags { |
| 1508 | if err := mountViaFds("", nil, m.Destination, dstFd, "", uintptr(pflag), ""); err != nil { |
| 1509 | return err |
| 1510 | } |
| 1511 | } |
| 1512 | return nil |
| 1513 | }); err != nil { |
| 1514 | return fmt.Errorf("change mount propagation through procfd: %w", err) |
| 1515 | } |
| 1516 | return nil |
| 1517 | } |
| 1518 | |
| 1519 | func setRecAttr(m mountEntry) error { |
| 1520 | if m.RecAttr == nil { |
no test coverage detected