picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

mount-util: accept that name_to_handle_at() might fail with EPERM (#5499)

Browse source 
Container managers frequently block name_to_handle_at(), returning
EACCES or EPERM when this is issued. Accept that, and simply fall back
to to fdinfo-based checks.

Note that we accept either EACCES or EPERM here, as container managers
can choose the error code and aren't very good on agreeing on just one.

(note that this is a non-issue with nspawn, as we permit
name_to_handle_at() there, only block open_by_handle_at(), which should
be sufficiently safe).
This commit is contained in:
Lennart Poettering 2017-03-01 17:35:05 +01:00 committed by Zbigniew Jędrzejewski-Szmek
parent a2b53448e4
commit 059c35f507
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/basic/mount-util.c
View file

@ -112,9 +112,10 @@ int fd_is_mount_point(int fd, const char *filename, int flags) {
r = name_to_handle_at(fd, filename, &h.handle, &mount_id, flags);
if (r < 0) {
if (errno == ENOSYS)
/* This kernel does not support name_to_handle_at()
* fall back to simpler logic. */
if (IN_SET(errno, ENOSYS, EACCES, EPERM))
/* This kernel does not support name_to_handle_at() at all, or the syscall was blocked (maybe
* through seccomp, because we are running inside of a container?): fall back to simpler
* logic. */
goto fallback_fdinfo;
else if (errno == EOPNOTSUPP)
/* This kernel or file system does not support
@ -163,7 +164,7 @@ int fd_is_mount_point(int fd, const char *filename, int flags) {
fallback_fdinfo:
r = fd_fdinfo_mnt_id(fd, filename, flags, &mount_id);
if (IN_SET(r, -EOPNOTSUPP, -EACCES))
if (IN_SET(r, -EOPNOTSUPP, -EACCES, -EPERM))
goto fallback_fstat;
if (r < 0)
return r;