StarMirror/sandboxed-api
1
0
Fork 0
mirror of https://github.com/google/sandboxed-api.git synced 2024-03-22 13:11:30 +08:00
Code Issues Projects Releases Wiki Activity

Properly set mount flags

Browse Source 
PiperOrigin-RevId: 290052082
Change-Id: I35222d25a24c3d641a998b2734b90bd178759df6
This commit is contained in:
Wiktor Garbacz 2020-01-16 06:04:44 -08:00 committed by Copybara-Service
parent c2bd47e978
commit 96d9ce90e5
1 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
sandboxed_api/sandbox2/mounts.cc
View File

@ -478,7 +478,10 @@ uint64_t GetMountFlagsFor(const std::string& path) {
void MountWithDefaults(const std::string& source, const std::string& target,
const char* fs_type, uint64_t extra_flags,
const char* option_str, bool is_ro) {
uint64_t flags = MS_REC | MS_NODEV | MS_NOSUID | extra_flags;
uint64_t flags = MS_REC | MS_NOSUID | extra_flags;
if (is_ro) {
flags |= MS_RDONLY;
}
SAPI_RAW_VLOG(1, R"(mount("%s", "%s", "%s", %d, "%s"))", source, target,
fs_type, flags, option_str);
@ -494,13 +497,22 @@ void MountWithDefaults(const std::string& source, const std::string& target,
SAPI_RAW_PLOG(FATAL, "mounting %s to %s failed", source, target);
}
// Bind mounting as read-only doesn't work, we have to remount it.
if (is_ro) {
// Flags are ignored for a bind mount, a remount is needed to set the flags.
if (extra_flags & MS_BIND) {
// Get actual mount flags.
flags |= GetMountFlagsFor(target);
res = mount("", target.c_str(), "", flags | MS_REMOUNT | MS_RDONLY,
option_str);
SAPI_RAW_PCHECK(res != -1, "remounting %s read-only failed", target);
res = mount("", target.c_str(), "", flags | MS_REMOUNT, nullptr);
SAPI_RAW_PCHECK(res != -1, "remounting %s with flags %d failed", target,
flags);
}
// Mount propagation has to be set separately
const uint64_t propagation =
extra_flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE);
if (propagation != 0) {
res = mount("", target.c_str(), "", propagation, nullptr);
SAPI_RAW_PCHECK(res != -1, "changing %s mount propagation to %d failed",
target, propagation);
}
}