maple/prplos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

procd: add patch to mount sys and proc with relatime option

Browse Source 
Lxc automatically mounts sys and proc in the rootfs of the container. When an unprivileged container is created however, the sys and proc of the host should be mounted with option relatime. The procd of openwrt mounts these with option noatime. As a result, an unprivileged container cannot start.

remounting them allows starting of the containers:
mount -t sys sys -o remount,rw,nosuid,nodev,noexec,relatime /sys
mount -t proc proc -o remount,rw,nosuid,nodev,noexec,relatime /proc

The patch modifies procd to do this correctly from the start.

Issue: LCMFT-338 for unprivileged lxc containers, proc and sys should be mounted with relatime
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
This commit is contained in:
Matthias FRANCK 2024-12-18 14:46:42 +01:00 committed by Petr Štetiar
parent 88ed25dfc7
commit 11293c4826
No known key found for this signature in database
GPG Key ID: 58EE120F30CC02D3
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
package/system/procd/patches/004-initd-mount-proc-sys-relatime.patch Normal file
View File

@ -0,0 +1,15 @@
diff --git a/initd/early.c b/initd/early.c
index 709f1b8..c82c1e2 100644
--- a/initd/early.c
+++ b/initd/early.c
@@ -109,8 +109,8 @@ early_mounts(void)
unsigned int oldumask = umask(0);
if (!is_container()) {
- mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL);
- mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL);
+ mount("proc", "/proc", "proc", MS_RELATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL);
+ mount("sysfs", "/sys", "sysfs", MS_RELATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL);
mount("efivars", "/sys/firmware/efi/efivars", "efivarfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL);
LOG("Attempting to mount cgroups (tmpfs + controller subdirs)\n");
mount("cgroup2", PATH_CGROUP, "tmpfs", MS_NODEV | MS_NOEXEC | MS_NOSUID, "size=512K");