proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-03 06:01:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

cgfs: don't mount /sys/fs/cgroup readonly

Browse Source 
/sys/fs/cgroup is just a size-limited tmpfs, and making it ro does
nothing to affect our ability alter mount settings of its subdirs.
OTOH making it ro can upset mountall in the container which tries
to remount it rw, which may be refused.

So just don't do it.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Christian Seiler <christian@iwakd.de>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
This commit is contained in:
Serge Hallyn 2014-05-02 11:35:10 -05:00 committed by Stéphane Graber
parent b9abc183b1
commit 8d783edcae
1 changed files with 0 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/lxc/cgfs.c
View File

@ -1413,14 +1413,6 @@ static bool cgroupfs_mount_cgroup(void *hdata, const char *root, int type)
SYSERROR("error bind-mounting %s to %s", mp->mount_point, abs_path);
goto out_error;
}
/* main cgroup path should be read-only */
if (type == LXC_AUTO_CGROUP_FULL_RO || type == LXC_AUTO_CGROUP_FULL_MIXED) {
r = mount(NULL, abs_path, NULL, MS_REMOUNT|MS_BIND|MS_RDONLY, NULL);
if (r < 0) {
SYSERROR("error re-mounting %s readonly", abs_path);
goto out_error;
}
}
/* own cgroup should be read-write */
if (type == LXC_AUTO_CGROUP_FULL_MIXED) {
r = mount(abs_path2, abs_path2, NULL, MS_BIND, NULL);
@ -1487,14 +1479,6 @@ static bool cgroupfs_mount_cgroup(void *hdata, const char *root, int type)
parts = NULL;
}
/* try to remount the tmpfs readonly, since the container shouldn't
* change anything (this will also make sure that trying to create
* new cgroups outside the allowed area fails with an error instead
* of simply causing this to create directories in the tmpfs itself)
*/
if (type != LXC_AUTO_CGROUP_RW && type != LXC_AUTO_CGROUP_FULL_RW)
mount(NULL, path, NULL, MS_REMOUNT|MS_RDONLY, NULL);
free(path);
return true;