linux: fix remount readonly in a user namespace
if we are remounting root read only when in a user namespace, make
sure the existing flags (e.g. MS_NOEXEC, MS_NODEV) are maintained
otherwise the mount fails with EPERM.
@@ -741,7 +741,19 @@ func prepareRoot(config *configs.Config) error {
}
func setReadonly() error {
- return unix.Mount("/", "/", "bind", unix.MS_BIND|unix.MS_REMOUNT|unix.MS_RDONLY|unix.MS_REC, "")
+ flags := uintptr(unix.MS_BIND | unix.MS_REMOUNT | unix.MS_RDONLY | unix.MS_REC)
+
+ err := unix.Mount("", "/", "", flags, "")
+ if err == nil {
+ return nil
+ }
+ var s unix.Statfs_t
+ if err := unix.Statfs("/", &s); err != nil {
+ return &os.PathError{Op: "statfs", Path: "/", Err: err}
+ }
+ flags |= uintptr(s.Flags)
+ return unix.Mount("", "/", "", flags, "")
+
}
func setupPtmx(config *configs.Config) error {
