vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Handle EBUSY on remount

Browse source 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-05-28 18:09:05 -07:00
parent 1dd391fe26
commit e8727a6236
1 changed files with 17 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
libcontainer/security/restrict/restrict.go
View file

@ -6,6 +6,7 @@ import (
"fmt" "fmt"
"os" "os"
"syscall" "syscall"
"time"
"github.com/dotcloud/docker/pkg/system" "github.com/dotcloud/docker/pkg/system"
) )
@ -13,21 +14,26 @@ import (
const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
func mountReadonly(path string) error { func mountReadonly(path string) error {
for i := 0; i < 5; i++ {
if err := system.Mount("", path, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil { if err := system.Mount("", path, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil {
if err == syscall.EINVAL { switch err {
case syscall.EINVAL:
// Probably not a mountpoint, use bind-mount // Probably not a mountpoint, use bind-mount
if err := system.Mount(path, path, "", syscall.MS_BIND, ""); err != nil { if err := system.Mount(path, path, "", syscall.MS_BIND, ""); err != nil {
return err return err
} }
if err := system.Mount(path, path, "", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC|defaultMountFlags, ""); err != nil { return system.Mount(path, path, "", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC|defaultMountFlags, "")
return err case syscall.EBUSY:
} time.Sleep(100 * time.Millisecond)
} else { continue
default:
return err return err
} }
} }
return nil return nil
} }
return fmt.Errorf("unable to mount %s as readonly max retries reached", path)
}
// This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts). // This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts).
// However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes). // However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes).
@ -38,6 +44,7 @@ func Restrict(mounts ...string) error {
return fmt.Errorf("unable to remount %s readonly: %s", dest, err) return fmt.Errorf("unable to remount %s readonly: %s", dest, err)
} }
} }
if err := system.Mount("/dev/null", "/proc/kcore", "", syscall.MS_BIND, ""); err != nil && !os.IsNotExist(err) { if err := system.Mount("/dev/null", "/proc/kcore", "", syscall.MS_BIND, ""); err != nil && !os.IsNotExist(err) {
return fmt.Errorf("unable to bind-mount /dev/null over /proc/kcore: %s", err) return fmt.Errorf("unable to bind-mount /dev/null over /proc/kcore: %s", err)
} }