libct: simplify setReadonly, fix losing rootfs flags

libcontainer/rootfs_linux.go

@@ -1126,17 +1126,17 @@ func prepareRootInHostMountNS(config *configs.Config) error {
 }
 
 func setReadonly() error {
-	flags := uintptr(unix.MS_BIND | unix.MS_REMOUNT | unix.MS_RDONLY)
-
-	err := mount("", "/", "", flags, "")
-	if err == nil {
-		return nil
-	}
+	// A bind remount sets the per-mount flags to exactly those given, so
+	// keep the existing nosuid, nodev, noexec and nosymfollow (otherwise
+	// they are cleared, or the remount fails in a userns where they are
+	// locked). Atime flags are not passed, so the kernel preserves them.
 	var s unix.Statfs_t
 	if err := unix.Statfs("/", &s); err != nil {
 		return &os.PathError{Op: "statfs", Path: "/", Err: err}
 	}
-	flags |= uintptr(s.Flags)
+	keep := statfsToMountFlags(s) & (unix.MS_NOSUID | unix.MS_NODEV | unix.MS_NOEXEC | unix.MS_NOSYMFOLLOW)
+	flags := uintptr(keep | unix.MS_BIND | unix.MS_REMOUNT | unix.MS_RDONLY)
+
 	return mount("", "/", "", flags, "")
 }
 

tests/integration/mounts.bats

@@ -7,6 +7,7 @@ function setup() {
 }
 
 function teardown() {
+	umount -l "$ROOT/bundle/rootfs" 2>/dev/null || true
 	teardown_bundle
 }
 
@@ -401,3 +402,19 @@ test_mount_target() {
 	rm -rf rootfs/tmp/hosts
 	test_mount_target . /etc/hosts /tmp/hosts
 }
+
+@test "runc run [readonly rootfs keeps nosuid,nodev]" {
+	requires root
+
+	mount --bind rootfs rootfs
+	mount -o remount,bind,nosuid,nodev rootfs
+
+	update_config '.root.readonly = true'
+	# shellcheck disable=SC2016
+	update_config --arg prog '$5 == "/" {print "," $6 ","}' \
+		'.process.args = ["awk", $prog, "/proc/self/mountinfo"]'
+	run -0 runc run test_busybox
+	assert_output --partial ",ro,"
+	assert_output --partial ",nosuid,"
+	assert_output --partial ",nodev,"
+}