2016-02-17 11:54:21 +01:00
|
|
|
/* bubblewrap
|
2016-02-16 10:03:46 +01:00
|
|
|
* Copyright (C) 2016 Alexander Larsson
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
|
* version 2 of the License, or (at your option) any later version.
|
|
|
|
|
*
|
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
|
|
|
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include "config.h"
|
|
|
|
|
|
|
|
|
|
#include <sys/mount.h>
|
|
|
|
|
|
|
|
|
|
#include "utils.h"
|
|
|
|
|
#include "bind-mount.h"
|
|
|
|
|
|
|
|
|
|
static char *
|
|
|
|
|
skip_token (char *line, bool eat_whitespace)
|
|
|
|
|
{
|
|
|
|
|
while (*line != ' ' && *line != '\n')
|
|
|
|
|
line++;
|
|
|
|
|
|
|
|
|
|
if (eat_whitespace && *line == ' ')
|
|
|
|
|
line++;
|
|
|
|
|
|
|
|
|
|
return line;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static char *
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
unescape_inline (char *escaped)
|
2016-02-16 10:03:46 +01:00
|
|
|
{
|
|
|
|
|
char *unescaped, *res;
|
|
|
|
|
const char *end;
|
|
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
res = escaped;
|
|
|
|
|
end = escaped + strlen (escaped);
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
unescaped = escaped;
|
2016-02-16 10:03:46 +01:00
|
|
|
while (escaped < end)
|
|
|
|
|
{
|
|
|
|
|
if (*escaped == '\\')
|
|
|
|
|
{
|
|
|
|
|
*unescaped++ =
|
2016-05-13 10:18:14 +02:00
|
|
|
((escaped[1] - '0') << 6) |
|
|
|
|
|
((escaped[2] - '0') << 3) |
|
|
|
|
|
((escaped[3] - '0') << 0);
|
2016-02-16 10:03:46 +01:00
|
|
|
escaped += 4;
|
|
|
|
|
}
|
|
|
|
|
else
|
2016-05-13 10:18:14 +02:00
|
|
|
{
|
|
|
|
|
*unescaped++ = *escaped++;
|
|
|
|
|
}
|
2016-02-16 10:03:46 +01:00
|
|
|
}
|
|
|
|
|
*unescaped = 0;
|
|
|
|
|
return res;
|
|
|
|
|
}
|
|
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
static bool
|
|
|
|
|
match_token (const char *token, const char *token_end, const char *str)
|
2016-02-16 10:03:46 +01:00
|
|
|
{
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
while (token != token_end && *token == *str)
|
2016-02-16 10:03:46 +01:00
|
|
|
{
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
token++;
|
|
|
|
|
str++;
|
2016-02-16 10:03:46 +01:00
|
|
|
}
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
if (token == token_end)
|
|
|
|
|
return *str == 0;
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
return FALSE;
|
2016-02-16 10:03:46 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static unsigned long
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
decode_mountoptions (const char *options)
|
2016-02-16 10:03:46 +01:00
|
|
|
{
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
const char *token, *end_token;
|
2016-02-16 10:03:46 +01:00
|
|
|
int i;
|
|
|
|
|
unsigned long flags = 0;
|
2016-05-13 10:18:14 +02:00
|
|
|
static const struct { int flag;
|
|
|
|
|
char *name;
|
|
|
|
|
} flags_data[] = {
|
2016-02-16 10:03:46 +01:00
|
|
|
{ 0, "rw" },
|
|
|
|
|
{ MS_RDONLY, "ro" },
|
|
|
|
|
{ MS_NOSUID, "nosuid" },
|
|
|
|
|
{ MS_NODEV, "nodev" },
|
|
|
|
|
{ MS_NOEXEC, "noexec" },
|
|
|
|
|
{ MS_NOATIME, "noatime" },
|
|
|
|
|
{ MS_NODIRATIME, "nodiratime" },
|
|
|
|
|
{ MS_RELATIME, "relatime" },
|
|
|
|
|
{ 0, NULL }
|
|
|
|
|
};
|
|
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
token = options;
|
2016-05-13 10:18:14 +02:00
|
|
|
do
|
|
|
|
|
{
|
|
|
|
|
end_token = strchr (token, ',');
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
if (end_token == NULL)
|
|
|
|
|
end_token = token + strlen (token);
|
2016-02-16 10:03:46 +01:00
|
|
|
|
2016-05-13 10:18:14 +02:00
|
|
|
for (i = 0; flags_data[i].name != NULL; i++)
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
{
|
|
|
|
|
if (match_token (token, end_token, flags_data[i].name))
|
|
|
|
|
{
|
|
|
|
|
flags |= flags_data[i].flag;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
if (*end_token != 0)
|
2016-05-13 10:18:14 +02:00
|
|
|
token = end_token + 1;
|
|
|
|
|
else
|
|
|
|
|
token = NULL;
|
|
|
|
|
}
|
|
|
|
|
while (token != NULL);
|
2016-02-16 10:03:46 +01:00
|
|
|
|
|
|
|
|
return flags;
|
|
|
|
|
}
|
|
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
typedef struct MountInfo MountInfo;
|
|
|
|
|
struct MountInfo {
|
|
|
|
|
char *mountpoint;
|
|
|
|
|
unsigned long options;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
typedef MountInfo *MountTab;
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
mount_tab_free (MountTab tab)
|
|
|
|
|
{
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
|
|
for (i = 0; tab[i].mountpoint != NULL; i++)
|
|
|
|
|
free (tab[i].mountpoint);
|
|
|
|
|
free (tab);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline void
|
|
|
|
|
cleanup_mount_tabp (void *p)
|
|
|
|
|
{
|
|
|
|
|
void **pp = (void **) p;
|
|
|
|
|
|
|
|
|
|
if (*pp)
|
|
|
|
|
mount_tab_free ((MountTab)*pp);
|
|
|
|
|
}
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
#define cleanup_mount_tab __attribute__((cleanup (cleanup_mount_tabp)))
|
|
|
|
|
|
|
|
|
|
typedef struct MountInfoLine MountInfoLine;
|
|
|
|
|
struct MountInfoLine {
|
|
|
|
|
const char *mountpoint;
|
|
|
|
|
const char *options;
|
|
|
|
|
bool covered;
|
|
|
|
|
int id;
|
|
|
|
|
int parent_id;
|
|
|
|
|
MountInfoLine *first_child;
|
|
|
|
|
MountInfoLine *next_sibling;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static unsigned int
|
|
|
|
|
count_lines (const char *data)
|
|
|
|
|
{
|
|
|
|
|
unsigned int count = 0;
|
|
|
|
|
const char *p = data;
|
|
|
|
|
|
|
|
|
|
while (*p != 0)
|
|
|
|
|
{
|
|
|
|
|
if (*p == '\n')
|
|
|
|
|
count++;
|
|
|
|
|
p++;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* If missing final newline, add one */
|
|
|
|
|
if (p > data && *(p-1) != '\n')
|
|
|
|
|
count++;
|
|
|
|
|
|
|
|
|
|
return count;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
count_mounts (MountInfoLine *line)
|
|
|
|
|
{
|
|
|
|
|
MountInfoLine *child;
|
|
|
|
|
int res = 0;
|
|
|
|
|
|
|
|
|
|
if (!line->covered)
|
|
|
|
|
res += 1;
|
|
|
|
|
|
|
|
|
|
child = line->first_child;
|
|
|
|
|
while (child != NULL)
|
|
|
|
|
{
|
|
|
|
|
res += count_mounts (child);
|
|
|
|
|
child = child->next_sibling;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return res;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static MountInfo *
|
|
|
|
|
collect_mounts (MountInfo *info, MountInfoLine *line)
|
|
|
|
|
{
|
|
|
|
|
MountInfoLine *child;
|
|
|
|
|
|
|
|
|
|
if (!line->covered)
|
|
|
|
|
{
|
|
|
|
|
info->mountpoint = xstrdup (line->mountpoint);
|
|
|
|
|
info->options = decode_mountoptions (line->options);
|
|
|
|
|
info ++;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
child = line->first_child;
|
|
|
|
|
while (child != NULL)
|
|
|
|
|
{
|
|
|
|
|
info = collect_mounts (info, child);
|
|
|
|
|
child = child->next_sibling;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return info;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static MountTab
|
|
|
|
|
parse_mountinfo (int proc_fd,
|
|
|
|
|
const char *root_mount)
|
2016-02-16 10:03:46 +01:00
|
|
|
{
|
|
|
|
|
cleanup_free char *mountinfo = NULL;
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
cleanup_free MountInfoLine *lines = NULL;
|
|
|
|
|
cleanup_free MountInfoLine **by_id = NULL;
|
|
|
|
|
cleanup_mount_tab MountTab mount_tab = NULL;
|
|
|
|
|
MountInfo *end_tab;
|
|
|
|
|
int n_mounts;
|
2016-02-16 10:03:46 +01:00
|
|
|
char *line;
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
int i;
|
|
|
|
|
int max_id;
|
|
|
|
|
unsigned int n_lines;
|
|
|
|
|
int root;
|
2016-02-16 10:03:46 +01:00
|
|
|
|
|
|
|
|
mountinfo = load_file_at (proc_fd, "self/mountinfo");
|
|
|
|
|
if (mountinfo == NULL)
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
die_with_error ("Can't open /proc/self/mountinfo");
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
n_lines = count_lines (mountinfo);
|
|
|
|
|
lines = xcalloc (n_lines * sizeof (MountInfoLine));
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
max_id = 0;
|
2016-02-16 10:03:46 +01:00
|
|
|
line = mountinfo;
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
i = 0;
|
|
|
|
|
root = -1;
|
2016-02-16 10:03:46 +01:00
|
|
|
while (*line != 0)
|
|
|
|
|
{
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
int rc, consumed = 0;
|
|
|
|
|
unsigned int maj, min;
|
|
|
|
|
char *end;
|
|
|
|
|
char *rest;
|
|
|
|
|
char *mountpoint;
|
|
|
|
|
char *mountpoint_end;
|
|
|
|
|
char *options;
|
|
|
|
|
char *options_end;
|
|
|
|
|
char *next_line;
|
|
|
|
|
|
|
|
|
|
assert (i < n_lines);
|
|
|
|
|
|
|
|
|
|
end = strchr (line, '\n');
|
|
|
|
|
if (end != NULL)
|
|
|
|
|
{
|
|
|
|
|
*end = 0;
|
|
|
|
|
next_line = end + 1;
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
next_line = line + strlen (line);
|
|
|
|
|
|
|
|
|
|
rc = sscanf (line, "%d %d %u:%u %n", &lines[i].id, &lines[i].parent_id, &maj, &min, &consumed);
|
|
|
|
|
if (rc != 4)
|
|
|
|
|
die ("Can't parse mountinfo line");
|
|
|
|
|
rest = line + consumed;
|
|
|
|
|
|
|
|
|
|
rest = skip_token (rest, TRUE); /* mountroot */
|
|
|
|
|
mountpoint = rest;
|
|
|
|
|
rest = skip_token (rest, FALSE); /* mountpoint */
|
|
|
|
|
mountpoint_end = rest++;
|
|
|
|
|
options = rest;
|
|
|
|
|
rest = skip_token (rest, FALSE); /* vfs options */
|
|
|
|
|
options_end = rest;
|
|
|
|
|
|
2016-02-16 10:03:46 +01:00
|
|
|
*mountpoint_end = 0;
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
lines[i].mountpoint = unescape_inline (mountpoint);
|
|
|
|
|
|
|
|
|
|
*options_end = 0;
|
|
|
|
|
lines[i].options = options;
|
|
|
|
|
|
|
|
|
|
if (lines[i].id > max_id)
|
|
|
|
|
max_id = lines[i].id;
|
|
|
|
|
if (lines[i].parent_id > max_id)
|
|
|
|
|
max_id = lines[i].parent_id;
|
|
|
|
|
|
|
|
|
|
if (path_equal (lines[i].mountpoint, root_mount))
|
|
|
|
|
root = i;
|
|
|
|
|
|
|
|
|
|
i++;
|
|
|
|
|
line = next_line;
|
|
|
|
|
}
|
|
|
|
|
assert (i == n_lines);
|
|
|
|
|
|
|
|
|
|
if (root == -1)
|
|
|
|
|
{
|
|
|
|
|
mount_tab = xcalloc (sizeof (MountInfo) * (1));
|
|
|
|
|
return steal_pointer (&mount_tab);
|
|
|
|
|
}
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
by_id = xcalloc ((max_id + 1) * sizeof (MountInfoLine*));
|
|
|
|
|
for (i = 0; i < n_lines; i++)
|
|
|
|
|
by_id[lines[i].id] = &lines[i];
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
for (i = 0; i < n_lines; i++)
|
|
|
|
|
{
|
|
|
|
|
MountInfoLine *this = &lines[i];
|
|
|
|
|
MountInfoLine *parent = by_id[this->parent_id];
|
|
|
|
|
MountInfoLine **to_sibling;
|
|
|
|
|
MountInfoLine *sibling;
|
|
|
|
|
bool covered = FALSE;
|
|
|
|
|
|
|
|
|
|
if (!has_path_prefix (this->mountpoint, root_mount))
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
if (parent == NULL)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
if (strcmp (parent->mountpoint, this->mountpoint) == 0)
|
|
|
|
|
parent->covered = TRUE;
|
|
|
|
|
|
|
|
|
|
to_sibling = &parent->first_child;
|
|
|
|
|
sibling = parent->first_child;
|
|
|
|
|
while (sibling != NULL)
|
2016-02-16 10:03:46 +01:00
|
|
|
{
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
/* If this mountpoint is a path prefix of the sibling,
|
|
|
|
|
* say this->mp=/foo/bar and sibling->mp=/foo, then it is
|
|
|
|
|
* covered by the sibling, and we drop it. */
|
|
|
|
|
if (has_path_prefix (this->mountpoint, sibling->mountpoint))
|
2016-02-16 10:03:46 +01:00
|
|
|
{
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
covered = TRUE;
|
|
|
|
|
break;
|
2016-02-16 10:03:46 +01:00
|
|
|
}
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
|
|
|
|
|
/* If the sibling is a path prefix of this mount point,
|
|
|
|
|
* say this->mp=/foo and sibling->mp=/foo/bar, then the sibling
|
|
|
|
|
* is covered, and we drop it.
|
|
|
|
|
*/
|
|
|
|
|
if (has_path_prefix (sibling->mountpoint, this->mountpoint))
|
|
|
|
|
*to_sibling = sibling->next_sibling;
|
|
|
|
|
else
|
|
|
|
|
to_sibling = &sibling->next_sibling;
|
|
|
|
|
sibling = sibling->next_sibling;
|
2016-02-16 10:03:46 +01:00
|
|
|
}
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
|
|
|
|
|
if (covered)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
*to_sibling = this;
|
2016-02-16 10:03:46 +01:00
|
|
|
}
|
|
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
n_mounts = count_mounts (&lines[root]);
|
|
|
|
|
mount_tab = xcalloc (sizeof (MountInfo) * (n_mounts + 1));
|
|
|
|
|
|
|
|
|
|
end_tab = collect_mounts (&mount_tab[0], &lines[root]);
|
|
|
|
|
assert (end_tab == &mount_tab[n_mounts]);
|
2016-02-16 10:03:46 +01:00
|
|
|
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
return steal_pointer (&mount_tab);
|
2016-02-16 10:03:46 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int
|
2016-05-13 10:18:14 +02:00
|
|
|
bind_mount (int proc_fd,
|
|
|
|
|
const char *src,
|
|
|
|
|
const char *dest,
|
2016-02-16 10:03:46 +01:00
|
|
|
bind_option_t options)
|
|
|
|
|
{
|
|
|
|
|
bool readonly = (options & BIND_READONLY) != 0;
|
|
|
|
|
bool devices = (options & BIND_DEVICES) != 0;
|
|
|
|
|
bool recursive = (options & BIND_RECURSIVE) != 0;
|
2016-03-07 19:14:30 +01:00
|
|
|
unsigned long current_flags, new_flags;
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
cleanup_mount_tab MountTab mount_tab = NULL;
|
2016-11-22 11:43:56 +01:00
|
|
|
cleanup_free char *resolved_dest = NULL;
|
2016-02-16 10:03:46 +01:00
|
|
|
int i;
|
|
|
|
|
|
2016-08-12 12:15:28 +02:00
|
|
|
if (src)
|
|
|
|
|
{
|
2017-09-25 23:27:29 -03:00
|
|
|
if (mount (src, dest, NULL, MS_BIND | (recursive ? MS_REC : 0), NULL) != 0)
|
2016-08-12 12:15:28 +02:00
|
|
|
return 1;
|
|
|
|
|
}
|
2016-02-16 10:03:46 +01:00
|
|
|
|
2016-11-22 11:43:56 +01:00
|
|
|
/* The mount operation will resolve any symlinks in the destination
|
|
|
|
|
path, so to find it in the mount table we need to do that too. */
|
|
|
|
|
resolved_dest = realpath (dest, NULL);
|
2016-12-13 13:56:23 +01:00
|
|
|
if (resolved_dest == NULL)
|
|
|
|
|
return 2;
|
2016-11-22 11:43:56 +01:00
|
|
|
|
|
|
|
|
mount_tab = parse_mountinfo (proc_fd, resolved_dest);
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
if (mount_tab[0].mountpoint == NULL)
|
|
|
|
|
{
|
|
|
|
|
errno = EINVAL;
|
|
|
|
|
return 2; /* No mountpoint at dest */
|
|
|
|
|
}
|
2016-02-16 10:03:46 +01:00
|
|
|
|
2016-11-22 11:43:56 +01:00
|
|
|
assert (path_equal (mount_tab[0].mountpoint, resolved_dest));
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
current_flags = mount_tab[0].options;
|
2016-05-13 10:18:14 +02:00
|
|
|
new_flags = current_flags | (devices ? 0 : MS_NODEV) | MS_NOSUID | (readonly ? MS_RDONLY : 0);
|
2016-03-07 19:14:30 +01:00
|
|
|
if (new_flags != current_flags &&
|
2016-11-22 11:43:56 +01:00
|
|
|
mount ("none", resolved_dest,
|
2017-09-25 23:27:29 -03:00
|
|
|
NULL, MS_BIND | MS_REMOUNT | new_flags, NULL) != 0)
|
2016-02-16 10:03:46 +01:00
|
|
|
return 3;
|
|
|
|
|
|
|
|
|
|
/* We need to work around the fact that a bind mount does not apply the flags, so we need to manually
|
|
|
|
|
* apply the flags to all submounts in the recursive case.
|
|
|
|
|
* Note: This does not apply the flags to mounts which are later propagated into this namespace.
|
|
|
|
|
*/
|
|
|
|
|
if (recursive)
|
|
|
|
|
{
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
for (i = 1; mount_tab[i].mountpoint != NULL; i++)
|
2016-02-16 10:03:46 +01:00
|
|
|
{
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
current_flags = mount_tab[i].options;
|
2016-05-13 10:18:14 +02:00
|
|
|
new_flags = current_flags | (devices ? 0 : MS_NODEV) | MS_NOSUID | (readonly ? MS_RDONLY : 0);
|
2016-03-07 19:14:30 +01:00
|
|
|
if (new_flags != current_flags &&
|
bind-mounts: Fix handling of covered mountpoints
Its not uncommon for mountpoints to cover other mountpoints, for instance
if /a/b is mounted first, then /a/b or /a can be mounted again effectively
making the old /a/b unreachable. This happens sometimes on the host
system, but it happens also often in the context of bubblewrap
where you migth do something like:
bwrap --bind / / --bind /my/foo /foo
In this case, we're covering whatever is on /foo on the host with
different content, and if /foo had submount under it these will be
covered.
There is a problem with bind mounts and covered mountpoints though.
Bubblewrap always does recursive bind-mounts (because a non-recursive
bind-mount could expose content that was otherwise covered), and the
linux recursive bind mount doesn't let you modify flags (such as
adding readonly). So we have to first bind-mount, and then change the
flags for the destination and all the submounts under it.
The existing naive implementation of submount enumeration in
bubblewrap also returns the covered mount points, and when we try
to change the flags on these we run into issues, because mount()
can't find the pathnames.
This implementation does a more thorough parsing of the mountinfo
file, looking at the "mount id" and "parent mount id" to reconstruct
exactly which mountpoints that are accessible.
This fixes https://github.com/projectatomic/bubblewrap/issues/14
Closes: #118
Approved by: alexlarsson
2016-11-10 20:50:53 +01:00
|
|
|
mount ("none", mount_tab[i].mountpoint,
|
2017-09-25 23:27:29 -03:00
|
|
|
NULL, MS_BIND | MS_REMOUNT | new_flags, NULL) != 0)
|
2016-03-07 19:26:05 +01:00
|
|
|
{
|
|
|
|
|
/* If we can't read the mountpoint we can't remount it, but that should
|
|
|
|
|
be safe to ignore because its not something the user can access. */
|
|
|
|
|
if (errno != EACCES)
|
|
|
|
|
return 5;
|
|
|
|
|
}
|
2016-02-16 10:03:46 +01:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|