Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/snap-confine: aggregate operations holding global lock #3262

Merged
merged 2 commits into from May 12, 2017
Merged

cmd/snap-confine: aggregate operations holding global lock #3262

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f0ccec8
cmd/snap-confine: aggregate operations holding global lock
zyga May 2, 2017
4de48ce
Merge branch 'master' into tweak/do-all-global-init-at-once
zyga May 10, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 4 additions & 8 deletions cmd/snap-confine/snap-confine.c
View file
Open in desktop
Expand Up @@ -105,12 +105,6 @@ int main(int argc, char **argv)
#endif // ifdef HAVE_SECCOMP

if (geteuid() == 0) {
// ensure that "/" or "/snap" is mounted with the
// "shared" option, see LP:#1668659
int global_lock_fd = sc_lock_global();
sc_ensure_shared_snap_mount();
sc_unlock_global(global_lock_fd);

if (classic_confinement) {
/* 'classic confinement' is designed to run without the sandbox
* inside the shared namespace. Specifically:
Expand Down Expand Up @@ -139,10 +133,12 @@ int main(int argc, char **argv)
sc_reassociate_with_pid1_mount_ns();
// Do global initialization:
int global_lock_fd = sc_lock_global();
// ensure that "/" or "/snap" is mounted with the
// "shared" option, see LP:#1668659
debug("ensuring that snap mount directory is shared");
sc_ensure_shared_snap_mount();
debug("unsharing snap namespace directory");
sc_initialize_ns_groups();
// TODO: implement this.
debug("share snap directory here...");
sc_unlock_global(global_lock_fd);

// Do per-snap initialization.
Expand Down