security/hakurei
security/hakurei
4
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

container/mount: move tmpfs sysroot prefixing to caller
All checks were successful
Test / Hakurei (push) Successful in 2m6s
Details
Test / Flake checks (push) Successful in 1m18s
Details
Test / Create distribution (push) Successful in 33s
Details
Test / Sandbox (push) Successful in 2m4s
Details
Test / Sandbox (race detector) (push) Successful in 3m54s
Details
Test / Hpkg (push) Successful in 4m0s
Details
Test / Hakurei (race detector) (push) Successful in 4m34s
Details

Browse Source 
The mountTmpfs helper is a relatively low level function that is not exposed as part of the API. Prefixing sysroot here not only introduces overhead but is also quite error-prone.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-08-03 18:06:41 +09:00
parent 6a3886e9db
commit 15170735ba
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
container/mount.go
View File

@ -160,8 +160,9 @@ func remountWithFlags(n *vfs.MountInfoNode, mf uintptr) error {
return nil
}
func mountTmpfs(fsname, name string, flags uintptr, size int, perm os.FileMode) error {
target := toSysroot(name)
// mountTmpfs mounts tmpfs on target;
// callers who wish to mount to sysroot must pass the return value of toSysroot.
func mountTmpfs(fsname, target string, flags uintptr, size int, perm os.FileMode) error {
if err := os.MkdirAll(target, parentPerm(perm)); err != nil {
return wrapErrSelf(err)
}
@ -171,7 +172,7 @@ func mountTmpfs(fsname, name string, flags uintptr, size int, perm os.FileMode)
}
return wrapErrSuffix(
Mount(fsname, target, FstypeTmpfs, flags, opt),
fmt.Sprintf("cannot mount tmpfs on %q:", name))
fmt.Sprintf("cannot mount tmpfs on %q:", target))
}
func parentPerm(perm os.FileMode) os.FileMode {

5
container/ops.go
View File

@ -190,13 +190,12 @@ type MountDevOp string
func (d MountDevOp) early(*Params) error { return nil }
func (d MountDevOp) apply(params *Params) error {
v := string(d)
if !path.IsAbs(v) {
return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", v))
}
target := toSysroot(v)
if err := mountTmpfs(SourceTmpfsDevtmpfs, v, MS_NOSUID|MS_NODEV, 0, params.ParentPerm); err != nil {
if err := mountTmpfs(SourceTmpfsDevtmpfs, target, MS_NOSUID|MS_NODEV, 0, params.ParentPerm); err != nil {
return err
}
@ -332,7 +331,7 @@ func (t *MountTmpfsOp) apply(*Params) error {
if t.Size < 0 || t.Size > math.MaxUint>>1 {
return msg.WrapErr(EBADE, fmt.Sprintf("size %d out of bounds", t.Size))
}
return mountTmpfs(t.FSName, t.Path, t.Flags, t.Size, t.Perm)
return mountTmpfs(t.FSName, toSysroot(t.Path), t.Flags, t.Size, t.Perm)
}
func (t *MountTmpfsOp) Is(op Op) bool { vt, ok := op.(*MountTmpfsOp); return ok && *t == *vt }