dev: Revert "Don't ignore container mounts based on their path"

This reverts commit 08909b2. We should not be passing any bind-mounts from /dev, /sys and /proc. Mounting these from the host inside the container does not make sense as these files are relevant to the host OS. Fixes #219 Signed-off-by: Archana Shinde <[email protected]>
kata-containers · Apr 19, 2018 · 10c596a · 10c596a
1 parent 1c7a02e
commit 10c596a
Show file tree

Hide file tree

Showing 3 changed files with 37 additions and 1 deletion.
diff --git a/virtcontainers/container.go b/virtcontainers/container.go
@@ -290,7 +290,7 @@ func (c *Container) createContainersDirs() error {
 func (c *Container) mountSharedDirMounts(hostSharedDir, guestSharedDir string) ([]Mount, error) {
 	var sharedDirMounts []Mount
 	for idx, m := range c.mounts {
-		if m.Type != "bind" {
+		if isSystemMount(m.Destination) || m.Type != "bind" {
 			continue
 		}
 

diff --git a/virtcontainers/mount.go b/virtcontainers/mount.go
@@ -18,6 +18,18 @@ import (
 
 var rootfsDir = "rootfs"
 
+var systemMountPrefixes = []string{"/proc", "/dev", "/sys"}
+
+func isSystemMount(m string) bool {
+	for _, p := range systemMountPrefixes {
+		if m == p || strings.HasPrefix(m, p+"/") {
+			return true
+		}
+	}
+
+	return false
+}
+
 func major(dev uint64) int {
 	return int((dev >> 8) & 0xfff)
 }

diff --git a/virtcontainers/mount_test.go b/virtcontainers/mount_test.go
@@ -18,6 +18,30 @@ import (
 	"testing"
 )
 
+func TestIsSystemMount(t *testing.T) {
+	tests := []struct {
+		mnt      string
+		expected bool
+	}{
+		{"/sys", true},
+		{"/sys/", true},
+		{"/sys//", true},
+		{"/sys/fs", true},
+		{"/sys/fs/", true},
+		{"/sys/fs/cgroup", true},
+		{"/sysfoo", false},
+		{"/home", false},
+		{"/dev/block/", true},
+	}
+
+	for _, test := range tests {
+		result := isSystemMount(test.mnt)
+		if result != test.expected {
+			t.Fatalf("Expected result for path %s : %v, got %v", test.mnt, test.expected, result)
+		}
+	}
+}
+
 func TestMajorMinorNumber(t *testing.T) {
 	devices := []string{"/dev/zero", "/dev/net/tun"}