[lxc-devel] [lxd/master] Bind-mount mqueue if unprivileged

[stgraber on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 474 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20160319/3d73d1e4/attachment.bin>
-------------- next part --------------
From fb502c4d2643a5e0007f1eed3eab8fc66dd743c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Sat, 19 Mar 2016 01:19:57 -0400
Subject: [PATCH] Bind-mount mqueue if unprivileged
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Systemd is pretty picky on having something mounted there, doesn't care
much whether it's optional or not though :)

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 lxd/container_lxc.go | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/lxd/container_lxc.go b/lxd/container_lxc.go
index d081a81..12bf400 100644
--- a/lxd/container_lxc.go
+++ b/lxd/container_lxc.go
@@ -318,13 +318,25 @@ func (c *containerLXC) initLXC() error {
 		return err
 	}
 
-	err = lxcSetConfigItem(cc, "lxc.mount.entry", "mqueue dev/mqueue mqueue rw,relatime,create=dir,optional")
-	if err != nil {
-		return err
+	bindMounts := []string{
+		"/proc/sys/fs/binfmt_misc",
+		"/sys/firmware/efi/efivars",
+		"/sys/fs/fuse/connections",
+		"/sys/fs/pstore",
+		"/sys/kernel/debug",
+		"/sys/kernel/security"}
+
+	if c.IsPrivileged() && !runningInUserns {
+		err = lxcSetConfigItem(cc, "lxc.mount.entry", "mqueue dev/mqueue mqueue rw,relatime,create=dir,optional")
+		if err != nil {
+			return err
+		}
+	} else {
+		bindMounts = append(bindMounts, "/dev/mqueue")
 	}
 
-	for _, mnt := range []string{"/proc/sys/fs/binfmt_misc", "/sys/firmware/efi/efivars", "/sys/fs/fuse/connections", "/sys/fs/pstore", "/sys/kernel/debug", "/sys/kernel/security"} {
-		err = lxcSetConfigItem(cc, "lxc.mount.entry", fmt.Sprintf("%s %s none rbind,optional", mnt, strings.TrimPrefix(mnt, "/")))
+	for _, mnt := range bindMounts {
+		err = lxcSetConfigItem(cc, "lxc.mount.entry", fmt.Sprintf("%s %s none rbind,create=dir,optional", mnt, strings.TrimPrefix(mnt, "/")))
 		if err != nil {
 			return err
 		}