Repository navigation
libct: simplify setReadonly, fix losing rootfs flags - #5588
Merged
Merged
Conversation
setReadonly remounts / with MS_BIND|MS_REMOUNT|MS_RDONLY. A bind remount sets the per-mount flags to exactly the ones given, so when not in a user namespace it silently clears nosuid, nodev, noexec and nosymfollow which may be set on the rootfs mount. This does not happen in a user namespace, where these flags are locked, so the remount fails, and the fallback keeps them. The fix is to always use the existing flags, not only on fallback. In other words, the fallback is no longer needed. While at it - use statfsToMountFlags to convert, since ST_* and MS_* values may differ (e.g. ST_NOSYMFOLLOW != MS_NOSYMFOLLOW); - do not take other flags (e.g *ATIME*) as the kernel preserves those on remount. Add an integration test. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
kolyshkin
added
the
backport/1.5-todo
kolyshkin
requested review from
AkihiroSuda,
cyphar,
lifubang and
rata
and removed request for
lifubang
October 28, 2026 02:00
Contributor
Author
|
@opencontainers/runc-maintainers PTAL; this one is easy to review and fixes a real bug (for a change). I'd like to port it to 1.5 branch as well. |
kolyshkin
changed the title
Contributor
Author
|
@opencontainers/runc-maintainers this needs a second LGTM |
Contributor
Author
|
NB: backporting this to 1.5 requires #5590! |
Contributor
Author
|
This is a real bug fix; PTAL @opencontainers/runc-maintainers 🙏🏻 |
AkihiroSuda
approved these changes
Nov 1, 2026
AkihiroSuda
enabled auto-merge
November 1, 2026 07:10
Merged
via the queue into
opencontainers:main
with commit Nov 1, 2026
ff9a0c1
96 of 97 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
setReadonlyremounts/withMS_BIND|MS_REMOUNT|MS_RDONLY. A bind remount sets the per-mount flags to exactly the ones given, so when not in a user namespace it silently clears nosuid, nodev, noexec and nosymfollow which may be set on the rootfs mount.This does not happen in a user namespace, where these flags are locked, so the remount fails, and the fallback keeps them.
The fix is to always use the existing flags, not only on fallback. In other words, the fallback is no longer needed.
While at it
Add an integration test.