picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

nspawn: mount custom paths before writing to /etc

Browse source 
Consider such configuration:

    $ systemd-nspawn --read-only --timezone=copy --resolv-conf=copy-host \
        --overlay="+/etc::/etc" <...>

Assuming one wants `/` to be read-only, DNS and `/etc/localtime` to
work. One way to do it is to create an overlay filesystem in `/etc/`.
However, systemd-nspawn tries to create `/etc/resolv.conf` and
`/etc/localtime` before mounting the custom paths, while `/` (and, by
extension, `/etc`) is read-only. Thus it fails to create those files.

Mounting custom paths before modifying anything in `/etc/` makes this
possible.

Full example:

```
$ debootstrap buster /var/lib/machines/t1 http://deb.debian.org/debian
$ systemd-nspawn --private-users=false --timezone=copy --resolv-conf=copy-host --read-only --tmpfs=/var --tmpfs=/run --overlay="+/etc::/etc" -D /var/lib/machines/t1 ping -c 1 example.com
Spawning container t1 on /var/lib/machines/t1.
Press ^] three times within 1s to kill container.
ping: example.com: Temporary failure in name resolution
Container t1 failed with error code 130.
```

With the patch:

```
$ sudo ./build/systemd-nspawn --private-users=false --timezone=copy --resolv-conf=copy-host --read-only --tmpfs=/var --tmpfs=/run --overlay="+/etc::/etc" -D /var/lib/machines/t1 ping -qc 1 example.com
Spawning container t1 on /var/lib/machines/t1.
Press ^] three times within 1s to kill container.
PING example.com (93.184.216.34) 56(84) bytes of data.

--- example.org ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 110.912/110.912/110.912/0.000 ms
Container t1 exited successfully.
```
This commit is contained in:
Motiejus Jakštys 2020-05-04 19:57:40 +03:00 committed by Lennart Poettering
parent 848cfa74d2
commit 5c4deb9a5c
1 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/nspawn/nspawn.c
View file

@ -3486,6 +3486,16 @@ static int outer_child(
if (r < 0)
return r;
r = mount_custom(
directory,
arg_custom_mounts,
arg_n_custom_mounts,
arg_uid_shift,
arg_selinux_apifs_context,
MOUNT_NON_ROOT_ONLY);
if (r < 0)
return r;
r = setup_timezone(directory);
if (r < 0)
return r;
@ -3502,16 +3512,6 @@ static int outer_child(
if (r < 0)
return r;
r = mount_custom(
directory,
arg_custom_mounts,
arg_n_custom_mounts,
arg_uid_shift,
arg_selinux_apifs_context,
MOUNT_NON_ROOT_ONLY);
if (r < 0)
return r;
if (!arg_use_cgns) {
r = mount_cgroups(
directory,