This repository has been archived by the owner on Feb 8, 2021. It is now read-only.
readonly rootfs support #638
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@bergwolf Any updates on this? |
|
The hyperstart part needs rebase. |
|
CI failures are because of |
Signed-off-by: Peng Tao <bergwolf@gmail.com>
ReadOnly option is added to container spec. Signed-off-by: Peng Tao <bergwolf@gmail.com>
bergwolf
force-pushed
the
rootfs-ro
branch
2 times, most recently
from
b42fca2
to
b6f3067
Compare
Mount rootfs readonly here so that even if user remount it rw inside container, the rootfs is still readonly. ``` [hypervsock@~]$sudo hyperctl run -t --read-only busybox / # mount share_dir on / type 9p (ro,sync,dirsync,relatime,trans=virtio) proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime) devtmpfs on /dev type devtmpfs (rw,nosuid,relatime,size=21984k,nr_inodes=5496,mode=755) tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,relatime) devpts on /dev/pts type devpts (rw,nosuid,relatime,mode=620,ptmxmode=666) share_dir on /etc/hosts type 9p (rw,sync,dirsync,nodev,relatime,trans=virtio) rootfs on /etc/hostname type rootfs (rw,size=21984k,nr_inodes=5496) / # mount / -o remount,rw / # mount share_dir on / type 9p (rw,sync,dirsync,relatime,trans=virtio) proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime) devtmpfs on /dev type devtmpfs (rw,nosuid,relatime,size=21984k,nr_inodes=5496,mode=755) tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,relatime) devpts on /dev/pts type devpts (rw,nosuid,relatime,mode=620,ptmxmode=666) share_dir on /etc/hosts type 9p (rw,sync,dirsync,nodev,relatime,trans=virtio) rootfs on /etc/hostname type rootfs (rw,size=21984k,nr_inodes=5496) / # touch foo touch: foo: Read-only file system ``` Signed-off-by: Peng Tao <bergwolf@gmail.com>
Signed-off-by: Peng Tao <bergwolf@gmail.com>
Signed-off-by: Peng Tao <bergwolf@gmail.com>
|
it seems that the ro-mount for btrfs driver is not included. |
|
hykins was running too slow (>40 mins) and timed out. retest this please @hykins |
laijs
reviewed
Jun 11, 2017
| @@ -446,6 +446,12 @@ func (s *BtrfsStorage) PrepareContainer(containerId, sharedDir string, readonly | |||
| if err := syscall.Mount(btrfsRootfs, mountPoint, "bind", syscall.MS_BIND, ""); err != nil { | |||
| return nil, fmt.Errorf("failed to mount %s to %s: %v", btrfsRootfs, mountPoint, err) | |||
| } | |||
| if readonly { | |||
There was a problem hiding this comment.
so there may be a security problem among these two mount operations. The early existing container can possible write to the roofs of this one.
There was a problem hiding this comment.
They are different subvolumes. It needs to break its own chroot sandbox to access another container's rootfs, no?
|
LGTM |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A new command line option
--read-onlyis added tohyperctl runandhyperctl createto enable readonly rootfs support. A new fieldreadonlyis added to container spec to enable it as well.Readonly rootfs is enforced in two ways:
Needs: hyperhq/hyperstart#314 hyperhq/runv#511
Fixes: #564