[iproute2] lib/namespace: don't try to mount rw /sys over a ro one

Message ID 20180212192312.3472-1-lkundrak@v3.sk
State Accepted
Delegated to: stephen hemminger
Headers show
Series
  • [iproute2] lib/namespace: don't try to mount rw /sys over a ro one
Related show

Commit Message

Lubomir Rintel Feb. 12, 2018, 7:23 p.m.
It will fail with EPERM on Linux 4.15.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
---
 lib/namespace.c | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

Comments

Phil Sutter Feb. 13, 2018, 10:55 a.m. | #1
On Mon, Feb 12, 2018 at 08:23:12PM +0100, Lubomir Rintel wrote:
> It will fail with EPERM on Linux 4.15.
> 
> Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>

Acked-by: Phil Sutter <phil@nwl.cc>
Stephen Hemminger Feb. 23, 2018, 4:08 p.m. | #2
On Mon, 12 Feb 2018 20:23:12 +0100
Lubomir Rintel <lkundrak@v3.sk> wrote:

> It will fail with EPERM on Linux 4.15.
> 
> Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>

Applied.

Patch

diff --git a/lib/namespace.c b/lib/namespace.c
index 30b51388..6f3356d0 100644
--- a/lib/namespace.c
+++ b/lib/namespace.c
@@ -7,6 +7,7 @@ 
  *		2 of the License, or (at your option) any later version.
  */
 
+#include <sys/statvfs.h>
 #include <fcntl.h>
 #include <dirent.h>
 #include <limits.h>
@@ -46,6 +47,8 @@  int netns_switch(char *name)
 {
 	char net_path[PATH_MAX];
 	int netns;
+	unsigned long mountflags = 0;
+	struct statvfs fsstat;
 
 	snprintf(net_path, sizeof(net_path), "%s/%s", NETNS_RUN_DIR, name);
 	netns = open(net_path, O_RDONLY | O_CLOEXEC);
@@ -73,12 +76,25 @@  int netns_switch(char *name)
 			strerror(errno));
 		return -1;
 	}
+
 	/* Mount a version of /sys that describes the network namespace */
-	if (umount2("/sys", MNT_DETACH) < 0) {
-		fprintf(stderr, "umount of /sys failed: %s\n", strerror(errno));
+
+	if (statvfs("/sys", &fsstat) < 0) {
+		fprintf(stderr, "could not stat /sys (not mounted?): %s\n",strerror(errno));
 		return -1;
 	}
-	if (mount(name, "/sys", "sysfs", 0, NULL) < 0) {
+	if (fsstat.f_flag & ST_RDONLY) {
+		/* If /sys is not writable (e.g. in a container), we can't
+		 * unmount the old /sys instance, but we can still mount a new
+		 * read-only instance over it. */
+		mountflags = MS_RDONLY;
+	} else {
+		if (umount2("/sys", MNT_DETACH) < 0) {
+			fprintf(stderr, "umount of /sys failed: %s\n", strerror(errno));
+			return -1;
+		}
+	}
+	if (mount(name, "/sys", "sysfs", mountflags, NULL) < 0) {
 		fprintf(stderr, "mount of /sys failed: %s\n",strerror(errno));
 		return -1;
 	}