mirror of
https://github.com/systemd/systemd.git
synced 2024-12-23 21:35:11 +03:00
nspawn: refuse to bind mount device node from host when --private-users= is specified
Also do not chown if a device node is bind-mounted.
Fixes #34243.
(cherry picked from commit efedb6b0f3
)
This commit is contained in:
parent
c90ae08b0a
commit
a23591891b
@ -2207,7 +2207,7 @@ static int copy_devnodes(const char *dest) {
|
||||
/* Explicitly warn the user when /dev is already populated. */
|
||||
if (errno == EEXIST)
|
||||
log_notice("%s/dev/ is pre-mounted and pre-populated. If a pre-mounted /dev/ is provided it needs to be an unpopulated file system.", dest);
|
||||
if (errno != EPERM)
|
||||
if (!ERRNO_IS_PRIVILEGE(errno) || arg_uid_shift != 0)
|
||||
return log_error_errno(errno, "mknod(%s) failed: %m", to);
|
||||
|
||||
/* Some systems abusively restrict mknod but allow bind mounts. */
|
||||
@ -2217,11 +2217,11 @@ static int copy_devnodes(const char *dest) {
|
||||
r = mount_nofollow_verbose(LOG_DEBUG, from, to, NULL, MS_BIND, NULL);
|
||||
if (r < 0)
|
||||
return log_error_errno(r, "Both mknod and bind mount (%s) failed: %m", to);
|
||||
}
|
||||
|
||||
} else {
|
||||
r = userns_lchown(to, 0, 0);
|
||||
if (r < 0)
|
||||
return log_error_errno(r, "chown() of device node %s failed: %m", to);
|
||||
}
|
||||
|
||||
dn = path_join("/dev", S_ISCHR(st.st_mode) ? "char" : "block");
|
||||
if (!dn)
|
||||
|
Loading…
Reference in New Issue
Block a user