Skip to content

Commit

Permalink
WIP allow chroot instead of pivot_root
Browse files Browse the repository at this point in the history
TODO: make this configurable or make it a fallback

pivot_root is not allowed in containers
  • Loading branch information
roberth committed Mar 11, 2019
1 parent 225ea6d commit c286afc
Showing 1 changed file with 3 additions and 20 deletions.
23 changes: 3 additions & 20 deletions src/libstore/build.cc
Original file line number Diff line number Diff line change
Expand Up @@ -2616,11 +2616,6 @@ void DerivationGoal::runChild()
throw SysError("unable to make '/' private mount");
}

/* Bind-mount chroot directory to itself, to treat it as a
different filesystem from /, as needed for pivot_root. */
if (mount(chrootRootDir.c_str(), chrootRootDir.c_str(), 0, MS_BIND, 0) == -1)
throw SysError(format("unable to bind mount '%1%'") % chrootRootDir);

/* Set up a nearly empty /dev, unless the user asked to
bind-mount the host /dev. */
Strings ss;
Expand Down Expand Up @@ -2724,23 +2719,11 @@ void DerivationGoal::runChild()
}

/* Do the chroot(). */
if (chdir(chrootRootDir.c_str()) == -1)
throw SysError(format("cannot change directory to '%1%'") % chrootRootDir);

if (mkdir("real-root", 0) == -1)
throw SysError("cannot create real-root directory");

if (pivot_root(".", "real-root") == -1)
throw SysError(format("cannot pivot old root directory onto '%1%'") % (chrootRootDir + "/real-root"));

if (chroot(".") == -1)
if (chroot(chrootRootDir.c_str()) == -1)
throw SysError(format("cannot change root directory to '%1%'") % chrootRootDir);

if (umount2("real-root", MNT_DETACH) == -1)
throw SysError("cannot unmount real root filesystem");

if (rmdir("real-root") == -1)
throw SysError("cannot remove real-root directory");
if (chdir("/") == -1)
throw SysError(format("cannot change directory to '/'") % chrootRootDir);

/* Switch to the sandbox uid/gid in the user namespace,
which corresponds to the build user or calling user in
Expand Down

0 comments on commit c286afc

Please sign in to comment.