fix: cgroup delegate

Fix mount option nsdelegate. It makes delegation safe (more restrictions in the cgroup namespace). Signed-off-by: Serge Logvinov <serge.logvinov@sinextra.dev>
siderolabs · Aug 23, 2021 · e24b93b · e24b93b
1 parent 751f64f
commit e24b93b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/internal/pkg/mount/cgroups.go b/internal/pkg/mount/cgroups.go
@@ -13,7 +13,7 @@ import (
 // CGroupMountPoints returns the cgroup mount points.
 func CGroupMountPoints() (mountpoints *Points, err error) {
 	cgroups := NewMountPoints()
-	cgroups.Set("cgroup2", NewMountPoint("cgroup", constants.CgroupMountPath, "cgroup2", unix.MS_NOSUID|unix.MS_NODEV|unix.MS_NOEXEC|unix.MS_RELATIME, "nsdelegate,memory_recursiveprot"))
+	cgroups.Set("cgroup2", NewMountPoint("cgroup", constants.CgroupMountPath, "cgroup2", unix.MS_NOSUID|unix.MS_NODEV|unix.MS_NOEXEC|unix.MS_RELATIME, "nsdelegate"))
 
 	return cgroups, nil
 }