From 180339f16bff1b3570a05416e279b8376e61514a Mon Sep 17 00:00:00 2001 From: Gao feng Date: Thu, 29 Oct 2015 09:21:46 +0800 Subject: [PATCH 1/2] Mount /dev/shm by default Signed-off-by: Gao feng --- src/container.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/container.c b/src/container.c index 63a2d11..1aad90b 100644 --- a/src/container.c +++ b/src/container.c @@ -109,6 +109,16 @@ static int container_setup_mount(struct hyper_container *container) return -1; } + if (hyper_mkdir("/dev/shm") < 0) { + fprintf(stderr, "create /dev/shm failed\n"); + return -1; + } + + if (mount("tmpfs", "/dev/shm/", "tmpfs", 0, NULL) < 0) { + perror("mount shm failed"); + return -1; + } + if (hyper_mkdir("/dev/pts") < 0) { fprintf(stderr, "create /dev/pts failed\n"); return -1; From 19da0a206827765e53864ea1639a8e9d8f8be767 Mon Sep 17 00:00:00 2001 From: Gao feng Date: Thu, 29 Oct 2015 10:00:59 +0800 Subject: [PATCH 2/2] add mount option for filesystems Signed-off-by: Gao feng --- src/container.c | 8 ++++---- src/init.c | 10 +++++----- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/container.c b/src/container.c index 1aad90b..3eaabeb 100644 --- a/src/container.c +++ b/src/container.c @@ -102,9 +102,9 @@ static int container_setup_mount(struct hyper_container *container) hyper_mkdir("/sys"); hyper_mkdir("/dev"); - if (mount("proc", "/proc", "proc", 0, NULL) < 0 || - mount("sysfs", "/sys", "sysfs", 0, NULL) < 0 || - mount("devtmpfs", "/dev", "devtmpfs", 0, NULL) < 0) { + if (mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0 || + mount("sysfs", "/sys", "sysfs", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0 || + mount("devtmpfs", "/dev", "devtmpfs", MS_NOSUID, NULL) < 0) { perror("mount basic filesystem for container failed"); return -1; } @@ -114,7 +114,7 @@ static int container_setup_mount(struct hyper_container *container) return -1; } - if (mount("tmpfs", "/dev/shm/", "tmpfs", 0, NULL) < 0) { + if (mount("tmpfs", "/dev/shm/", "tmpfs", MS_NOSUID| MS_NODEV, NULL) < 0) { perror("mount shm failed"); return -1; } diff --git a/src/init.c b/src/init.c index 58c2ecb..00b1d8b 100644 --- a/src/init.c +++ b/src/init.c @@ -319,7 +319,7 @@ static int hyper_pod_init(void *data) goto fail; } - if (mount("proc", "/proc", "proc", 0, NULL) < 0) { + if (mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) < 0) { perror("mount proc filesystem failed\n"); goto fail; } @@ -1204,19 +1204,19 @@ int main(int argc, char *argv[]) return -1; } - if (mount("proc", "/proc", "proc", 0, NULL) == -1) { + if (mount("proc", "/proc", "proc", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) == -1) { perror("mount proc failed"); return -1; } hyper_print_uptime(); - if (mount("sysfs", "/sys", "sysfs", 0, NULL) == -1) { + if (mount("sysfs", "/sys", "sysfs", MS_NOSUID| MS_NODEV| MS_NOEXEC, NULL) == -1) { perror("mount sysfs failed"); return -1; } - if (mount("dev", "/dev", "devtmpfs", 0, NULL) == -1) { + if (mount("dev", "/dev", "devtmpfs", MS_NOSUID, NULL) == -1) { perror("mount sysfs failed"); return -1; } @@ -1226,7 +1226,7 @@ int main(int argc, char *argv[]) return -1; } - if (mount("devpts", "/dev/pts", "devpts", 0, NULL) == -1) { + if (mount("devpts", "/dev/pts", "devpts", MS_NOSUID| MS_NOEXEC, NULL) == -1) { perror("mount devpts failed"); return -1; }