Skip to content

libct: fix rootfs mount leak with --no-pivot and shared root #5532

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kolyshkin wants to merge 1 commit into
base: main
Choose a base branch
from
Open

libct: fix rootfs mount leak with --no-pivot and shared root #5532

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions libcontainer/rootfs_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1256,6 +1256,12 @@ func msMoveRoot(rootfs string) error {
}
}

// If "/" is shared (e.g. rootfsPropagation is set to "rshared"),
// the move below propagates to the host, mounting the container
// rootfs on top of the host's "/". Make "/" a slave to prevent that.
if err := mount("", "/", "", unix.MS_SLAVE, ""); err != nil {
return err
}
// Move the rootfs on top of "/" in our mount namespace.
if err := mount(rootfs, "/", "", unix.MS_MOVE, ""); err != nil {
return err
Expand Down
22 changes: 22 additions & 0 deletions tests/integration/no_pivot.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ function setup() {
}

function teardown() {
if [ -v ROOT ] && mountpoint -q "$ROOT/bundle/rootfs"; then
umount -R --lazy "$ROOT/bundle/rootfs"
fi
teardown_bundle
}

Expand Down Expand Up @@ -34,3 +37,22 @@ function teardown() {
run -1 runc run --no-pivot test_no_pivot
assert_output --partial "unable to use no-pivot without a private MNT namespace"
}

# https://github.com/opencontainers/runc/issues/1961
@test "runc run --no-pivot [rootfsPropagation rshared] must not leak rootfs mount" {
# Unsafe because, if the bug is present, the leaked mount on top
# of the host's "/" can not be removed, breaking the host.
requires root unsafe

update_config ' .linux.rootfsPropagation = "rshared"
| .process.args = ["true"]
| .process.terminal = false'

# The issue is only reproducible if rootfs is a mount.
mount --bind rootfs rootfs

before=$(awk '$5 == "/"' /proc/self/mountinfo | wc -l)
run -0 runc run --no-pivot test_no_pivot
after=$(awk '$5 == "/"' /proc/self/mountinfo | wc -l)
[ "$before" -eq "$after" ]
}
Loading