[lxc-devel] [lxd/master] lxd/devices/disk: Prevent recursive & readonly

[stgraber on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 370 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20200412/c40885b1/attachment.bin>
-------------- next part --------------
From 5fadb73a7f39606aa34a6b03c2e7bd5b3b4627dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Sun, 12 Apr 2020 23:04:52 -0400
Subject: [PATCH] lxd/devices/disk: Prevent recursive & readonly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #7174

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 lxd/device/disk.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lxd/device/disk.go b/lxd/device/disk.go
index 7996af578f..5d8fe184f6 100644
--- a/lxd/device/disk.go
+++ b/lxd/device/disk.go
@@ -122,6 +122,10 @@ func (d *disk) validateConfig(instConf instance.ConfigReader) error {
 		return fmt.Errorf("The recursive option is only supported for additional bind-mounted paths")
 	}
 
+	if shared.IsTrue(d.config["recursive"]) && shared.IsTrue(d.config["readonly"]) {
+		return fmt.Errorf("Recursive read-only bind-mounts aren't currently supported by the kernel")
+	}
+
 	if !(strings.HasPrefix(d.config["source"], "ceph:") || strings.HasPrefix(d.config["source"], "cephfs:")) && (d.config["ceph.cluster_name"] != "" || d.config["ceph.user_name"] != "") {
 		return fmt.Errorf("Invalid options ceph.cluster_name/ceph.user_name for source %q", d.config["source"])
 	}