kelvin/warewulf
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

respect read only rootfs for containers

Browse Source
This commit is contained in:
Christian Goll
2023-01-16 10:58:58 +01:00
parent 7ade65c73f
commit d30d523866
2 changed files with 81 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
internal/app/wwctl/container/exec/child/main.go
View File

@@ -29,16 +29,23 @@ func CobraRunE(cmd *cobra.Command, args []string) error {
os.Exit(1)
}
containerPath := container.RootFsDir(containerName)
mountFlags := uintptr(syscall.MS_PRIVATE | syscall.MS_REC)
if unix.Access(containerPath, unix.W_OK) != nil {
wwlog.Verbose("Path %s is readonly, mounting %s as ro", containerPath, containerName)
mountFlags |= syscall.MS_RDONLY
}
err := syscall.Mount("", "/", "", mountFlags, "")
err := syscall.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, "")
if err != nil {
return errors.Wrap(err, "failed to mount")
}
ps1Str := fmt.Sprintf("[%s] Warewulf> ", containerName)
if !util.IsWriteAble(containerPath) {
wwlog.Verbose("mounting %s ro", containerPath)
ps1Str = fmt.Sprintf("[%s] (ro) Warewulf> ", containerName)
err = syscall.Mount(containerPath, containerPath, "", syscall.MS_BIND, "")
if err != nil {
return errors.Wrap(err, fmt.Sprintf("failed to prepare bind mount"))
}
err = syscall.Mount(containerPath, containerPath, "", syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_BIND, "")
if err != nil {
return errors.Wrap(err, fmt.Sprintf("failed to remount ro"))
}
}
err = syscall.Mount("/dev", path.Join(containerPath, "/dev"), "", syscall.MS_BIND, "")
if err != nil {
@@ -80,7 +87,7 @@ func CobraRunE(cmd *cobra.Command, args []string) error {
return errors.Wrap(err, "failed to mount proc")
}
os.Setenv("PS1", fmt.Sprintf("[%s] Warewulf> ", containerName))
os.Setenv("PS1", ps1Str)
os.Setenv("PATH", "/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin")
os.Setenv("HISTFILE", "/dev/null")