From: Felix Bier <Felix.Bier@rohde-schwarz.com>
To: "gentoo-catalyst@lists.gentoo.org" <gentoo-catalyst@lists.gentoo.org>
Subject: [gentoo-catalyst] [PATCH] catalyst: Restore root and cwd after exiting mount namespace
Date: Mon, 9 Nov 2020 19:36:33 +0000 [thread overview]
Message-ID: <5fa82ef4b4010271be53a5d5c94e5c19b81f2bb3.camel@rohde-schwarz.com> (raw)
This commit saves the file descriptor of /proc/self/{root,cwd}
before entering into the new mount namespace. When restoring the
previous mount namespace, it restores /proc/self/{root,cwd}
based on the saved file descriptors.
Without this change, catalyst cannot be run in a chroot when
using the recent changes regarding mount namespaces: After the
mount namespace has been exited, /proc/self/root points to the "/"
of the host system, not the "/" of the chroot. Therefore, the
cleanup phase of catalyst runs outside of the chroot.
The code is similar to how nsenter(1) sets root and cwd:
https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/sys-utils/nsenter.c#n452
Tested in a Gentoo chroot and in Gentoo VM (non-chroot).
Signed-off-by: Felix Bier <felix.bier@rohde-schwarz.com>
---
catalyst/context.py | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/catalyst/context.py b/catalyst/context.py
index 8a58f33d..01a6d930 100644
--- a/catalyst/context.py
+++ b/catalyst/context.py
@@ -16,11 +16,21 @@ def namespace(mount=False, uts=False, ipc=False, net=False, pid=False,
(user, "user"): None,
}
+ dirs = {
+ "root": None,
+ "cwd": None,
+ }
+
# Save fds of current namespaces
for ns in [ns for ns in namespaces if ns[0]]:
fp = open(f"/proc/self/ns/{ns[1]}")
namespaces[ns] = fp
+ # Save fds of current directories
+ if mount:
+ for d in dirs:
+ dirs[d] = os.open(f"/proc/self/{d}", os.O_RDONLY)
+
simple_unshare(mount=mount, uts=uts, ipc=ipc, net=net, pid=pid, user=user,
hostname=hostname)
try:
@@ -30,3 +40,15 @@ def namespace(mount=False, uts=False, ipc=False, net=False, pid=False,
fp = namespaces[ns]
setns(fp.fileno(), 0)
fp.close()
+
+ if mount:
+ # Restore original root and cwd. Since we cannot directly chroot to
+ # a fd, first change the current directory to the fd of the
+ # original root, then chroot to "."
+
+ os.fchdir(dirs["root"])
+ os.chroot(".")
+ os.fchdir(dirs["cwd"])
+
+ for fd in dirs.values():
+ os.close(fd)
--
2.29.2
next reply other threads:[~2020-11-09 19:36 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-09 19:36 Felix Bier [this message]
2020-11-14 16:40 ` [gentoo-catalyst] [PATCH] catalyst: Restore root and cwd after exiting mount namespace Matt Turner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5fa82ef4b4010271be53a5d5c94e5c19b81f2bb3.camel@rohde-schwarz.com \
--to=felix.bier@rohde-schwarz.com \
--cc=gentoo-catalyst@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox