From 11293c4826d0b62021b7f162e8c19ef3d4ae0cd9 Mon Sep 17 00:00:00 2001 From: Matthias FRANCK Date: Wed, 18 Dec 2024 14:46:42 +0100 Subject: [PATCH] procd: add patch to mount sys and proc with relatime option Lxc automatically mounts sys and proc in the rootfs of the container. When an unprivileged container is created however, the sys and proc of the host should be mounted with option relatime. The procd of openwrt mounts these with option noatime. As a result, an unprivileged container cannot start. remounting them allows starting of the containers: mount -t sys sys -o remount,rw,nosuid,nodev,noexec,relatime /sys mount -t proc proc -o remount,rw,nosuid,nodev,noexec,relatime /proc The patch modifies procd to do this correctly from the start. Issue: LCMFT-338 for unprivileged lxc containers, proc and sys should be mounted with relatime Signed-off-by: Matthias FRANCK --- .../004-initd-mount-proc-sys-relatime.patch | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 package/system/procd/patches/004-initd-mount-proc-sys-relatime.patch diff --git a/package/system/procd/patches/004-initd-mount-proc-sys-relatime.patch b/package/system/procd/patches/004-initd-mount-proc-sys-relatime.patch new file mode 100644 index 0000000000..8dcf141ced --- /dev/null +++ b/package/system/procd/patches/004-initd-mount-proc-sys-relatime.patch @@ -0,0 +1,15 @@ +diff --git a/initd/early.c b/initd/early.c +index 709f1b8..c82c1e2 100644 +--- a/initd/early.c ++++ b/initd/early.c +@@ -109,8 +109,8 @@ early_mounts(void) + unsigned int oldumask = umask(0); + + if (!is_container()) { +- mount("proc", "/proc", "proc", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL); +- mount("sysfs", "/sys", "sysfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL); ++ mount("proc", "/proc", "proc", MS_RELATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL); ++ mount("sysfs", "/sys", "sysfs", MS_RELATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL); + mount("efivars", "/sys/firmware/efi/efivars", "efivarfs", MS_NOATIME | MS_NODEV | MS_NOEXEC | MS_NOSUID, NULL); + LOG("Attempting to mount cgroups (tmpfs + controller subdirs)\n"); + mount("cgroup2", PATH_CGROUP, "tmpfs", MS_NODEV | MS_NOEXEC | MS_NOSUID, "size=512K");