cmd/snap-confine: handle mounted shared /run/snapd/ns #6159
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
zyga
force-pushed
the
fix/lp-1803542
branch
2 times, most recently
from
7db5561
to
fe3eae8
Compare
zyga
commented
Nov 20, 2018
bboozzoo
approved these changes
Nov 20, 2018
The code that handles special sharing mode of /run/snapd/ns did cope with /run/snapd/ns being a private mount point and not being a mount point at all. When it was a mount point but one with shared mount event propagation all kinds of hell would break loose. This patch fixes this. The existing unit tests were nixed and replaced with a much more readable and comprehensive spread test. Fixes: https://bugs.launchpad.net/snapd/+bug/1803542 Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Instead of using findmnt to find a mount point and show the mount event propagation with -o PROPAGATION we can look at /proc/self/mountinfo and do the unholy grep awk cut combo. Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
|
|
I saw the failure last night, I need to look at that. |
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
|
I reproduced the bug, looks like something didn't clean up after itself in a prior test. |
|
This is blocked by a bug fixed by #6203 |
stolowski
approved these changes
Nov 27, 2018
| private) | ||
| mkdir -p /run/snapd/ns | ||
| mount --bind /run/snapd/ns /run/snapd/ns | ||
| mount --make-private /run/snapd/ns |
There was a problem hiding this comment.
Should we do anything about these mount points in restore:?
There was a problem hiding this comment.
Not really, snap-confine restores the correct setup on each execution. We don't have to unmount them. The code here is what snap-confine does internally.
| VARIANT/absent: absent | ||
| VARIANT/present: present | ||
| VARIANT/shared: shared | ||
| VARIANT/private: private |
There was a problem hiding this comment.
Yeah, worked better than the unit test :)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The code that handles special sharing mode of /run/snapd/ns did cope
with /run/snapd/ns being a private mount point and not being a mount
point at all. When it was a mount point but one with shared mount event
propagation all kinds of hell would break loose. This patch fixes this.
The existing unit tests were nixed and replaced with a much more
readable and comprehensive spread test.
Fixes: https://bugs.launchpad.net/snapd/+bug/1803542
Signed-off-by: Zygmunt Krynicki me@zygoon.pl