rustjail: separated the propagation flags from mount flags

[lifupan]

Since the propagation flags couldn't be combinted with the
standard mount flags, and they should be used with the remount,
thus it's better to split them from the standard mount flags.

Fixes: #1699

Signed-off-by: fupan.lfp fupan.lfp@antgroup.com

[fidencio]

@lifupan, thanks! I've opened kata-containers/tests#3524 to test this one!

[fidencio]

@lifupan, this PR did not work the issue around (http://jenkins.katacontainers.io/job/kata-containers-2.0-tests-debian-PR/773/console):

11:26:26 # Events:
11:26:26 #   Type     Reason     Age               From               Message
11:26:26 #   ----     ------     ----              ----               -------
11:26:26 #   Normal   Scheduled  90s               default-scheduler  Successfully assigned default/sysctl-test to debian10-azurec82ec0
11:26:26 #   Normal   Pulled     86s               kubelet            Successfully pulled image "quay.io/prometheus/busybox:latest" in 359.563447ms
11:26:26 #   Normal   Pulled     85s               kubelet            Successfully pulled image "quay.io/prometheus/busybox:latest" in 240.202972ms
11:26:26 #   Normal   Pulled     71s               kubelet            Successfully pulled image "quay.io/prometheus/busybox:latest" in 232.578165ms
11:26:26 #   Normal   Pulled     59s               kubelet            Successfully pulled image "quay.io/prometheus/busybox:latest" in 233.270474ms
11:26:26 #   Normal   Pulled     43s               kubelet            Successfully pulled image "quay.io/prometheus/busybox:latest" in 288.977756ms
11:26:26 #   Normal   Pulled     31s               kubelet            Successfully pulled image "quay.io/prometheus/busybox:latest" in 258.61503ms
11:26:26 #   Normal   Pulled     17s               kubelet            Successfully pulled image "quay.io/prometheus/busybox:latest" in 230.233531ms
11:26:26 #   Normal   Pulling    5s (x8 over 87s)  kubelet            Pulling image "quay.io/prometheus/busybox:latest"
11:26:26 #   Warning  Failed     4s (x8 over 86s)  kubelet            Error: CreateContainer failed: EINVAL: Invalid argument: unknown
11:26:26 #   Normal   Pulled     4s                kubelet            Successfully pulled image "quay.io/prometheus/busybox:latest" in 279.25102ms
11:26:26 # pod "sysctl-test" deleted
11:26:26 Failed at 81: bats "${K8S_TEST_ENTRY}"

[fidencio]

@lifupan, I've opened (and cc'ed you to) cri-o/cri-o#4896. This is basically a "revert" of the change that broke privileged containers, but only for the "VM" runtime type (which is what CRI-O uses to spawn kata-containers).

Please, let me know whether you think it'd be better to fix this on the kata-containers side, or if you think it's better to have it fixed on the CRI-O side.

I, personally, have no strong opinion and will follow what you think may be the best approach.

[lifupan]

@lifupan, I've opened (and cc'ed you to) cri-o/cri-o#4896. This is basically a "revert" of the change that broke privileged containers, but only for the "VM" runtime type (which is what CRI-O uses to spawn kata-containers).

Please, let me know whether you think it'd be better to fix this on the kata-containers side, or if you think it's better to have it fixed on the CRI-O side.

I, personally, have no strong opinion and will follow what you think may be the best approach.

Hi @fidencio

The centos and debian test cases passed.

[lifupan]

/test

[fidencio]

@lifupan, I've opened (and cc'ed you to) cri-o/cri-o#4896. This is basically a "revert" of the change that broke privileged containers, but only for the "VM" runtime type (which is what CRI-O uses to spawn kata-containers).
Please, let me know whether you think it'd be better to fix this on the kata-containers side, or if you think it's better to have it fixed on the CRI-O side.
I, personally, have no strong opinion and will follow what you think may be the best approach.

Hi @fidencio

The centos and debian test cases passed.

YAY!!!

[fidencio]

/test

[fidencio]

works for me, as in it passes the tests, thanks @lifupan!

@mxpv, may I bother you for a review on this one?

I really would like to have this one as part of the 2.1.0 release we'll cut Tomorrow.

[giuseppe]

LGTM