Add flag in mount_entry to skip NODEV in case of a persistent dev entry

[rsampaio]

Add flag in mount_entry to skip NODEV in case of a persistent dev entry

Since 1.0.7 persistent /dev mount entries that lives in a parent filesystems with nodev flag will inherit the flag even adding "dev" to mount options and cause access denied errors for /dev/urandom and /dev/null, with this change the mount option will be respected when a persistent dev is used.

Signed-off-by: Rodrigo Vaz rodrigo@heroku.com

[lxc-jenkins]

This pull request didn't trigger Jenkins as its author isn't in the whitelist.

An organization member must perform one of the following:

• To have this branch tested by Jenkins, use the "ok to test" command.
• To have a one time test done, use the "test this please" command.

Those commands are simple Github comments of the format: "jenkins: COMMAND"

[rsampaio]

if this changes make sense should I open different PRs for stable-1.0 ? The diff has slightly different offsets.

[brauner]

jenkins: test this please

[stgraber]

jenkins: test this please

[rsampaio]

Is this good to be merged? I'm specially interested in the stable-1.0 branch since with this change we should be able to move to an up to date version of LXC.

[stgraber]

@hallyn @brauner opinions on this?

[brauner]

I think @hallyn and I discussed this on irc and came to the conclusion that not adding the MS_NODEV flag when it is in sb.f_flags might lead the kernel to refuse the mount. But @hallyn acked this patch on the mailing list so I let him call it.

[rsampaio]

Thanks!

The diff for stable-1.0 with slightly different offset is here if it is useful, I can also open a new PR for that branch if necessary:

--- lxc-1.0.8.orig/src/lxc/conf.c
+++ lxc-1.0.8/src/lxc/conf.c
@@ -2045,7 +2045,7 @@ static char *get_field(char *src, int nf

 static int mount_entry(const char *fsname, const char *target,
               const char *fstype, unsigned long mountflags,
-              const char *data, int optional, const char *rootfs)
+              const char *data, int optional, int dev, const char *rootfs)
 {
 #ifdef HAVE_STATVFS
    struct statvfs sb;
@@ -2074,7 +2074,7 @@ static int mount_entry(const char *fsnam
            unsigned long required_flags = rqd_flags;
            if (sb.f_flag & MS_NOSUID)
                required_flags |= MS_NOSUID;
-           if (sb.f_flag & MS_NODEV)
+           if (sb.f_flag & MS_NODEV && !dev)
                required_flags |= MS_NODEV;
            if (sb.f_flag & MS_RDONLY)
                required_flags |= MS_RDONLY;
@@ -2357,6 +2357,7 @@ static inline int mount_entry_on_generic
    char *mntdata;
    int ret;
    bool optional = hasmntopt(mntent, "optional") != NULL;
+   bool dev = hasmntopt(mntent, "dev") != NULL;

    ret = mount_entry_create_dir_file(mntent, path, rootfs, lxc_name, lxc_path);

@@ -2371,7 +2372,7 @@ static inline int mount_entry_on_generic
    }

    ret = mount_entry(mntent->mnt_fsname, path, mntent->mnt_type, mntflags,
-             mntdata, optional,
+             mntdata, optional, dev,
              rootfs->path ? rootfs->mount : NULL);

    free(mntdata);