From bfc51cf6605ebcf7a4ec791fb0f3b5ae7b05c6fd Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Thu, 30 Jul 2015 10:26:45 -0700 Subject: [PATCH] Don't mount /proc as ro This caused a regression with LSM labeling. Signed-off-by: Michael Crosby --- daemon/execdriver/native/create.go | 2 +- integration-cli/docker_cli_exec_test.go | 7 +++++++ integration-cli/docker_cli_run_test.go | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/daemon/execdriver/native/create.go b/daemon/execdriver/native/create.go index dc3eacf9af..706bb17f6f 100644 --- a/daemon/execdriver/native/create.go +++ b/daemon/execdriver/native/create.go @@ -85,7 +85,7 @@ func (d *Driver) createContainer(c *execdriver.Command) (*configs.Config, error) } /* These paths must be remounted as r/o */ - container.ReadonlyPaths = append(container.ReadonlyPaths, "/proc", "/dev") + container.ReadonlyPaths = append(container.ReadonlyPaths, "/dev") } if err := d.setupMounts(container, c); err != nil { diff --git a/integration-cli/docker_cli_exec_test.go b/integration-cli/docker_cli_exec_test.go index b4f5c57787..084edf3bc1 100644 --- a/integration-cli/docker_cli_exec_test.go +++ b/integration-cli/docker_cli_exec_test.go @@ -543,3 +543,10 @@ func (s *DockerSuite) TestExecWithImageUser(c *check.C) { c.Fatalf("exec with user by id expected dockerio user got %s", out) } } + +func (s *DockerSuite) TestExecOnReadonlyContainer(c *check.C) { + dockerCmd(c, "run", "-d", "--read-only", "--name", "parent", "busybox", "top") + if _, status := dockerCmd(c, "exec", "parent", "true"); status != 0 { + c.Fatalf("exec into a read-only container failed with exit status %d", status) + } +} diff --git a/integration-cli/docker_cli_run_test.go b/integration-cli/docker_cli_run_test.go index 761217bc1b..57093ee8d9 100644 --- a/integration-cli/docker_cli_run_test.go +++ b/integration-cli/docker_cli_run_test.go @@ -2242,7 +2242,7 @@ func (s *DockerSuite) TestRunContainerWithWritableRootfs(c *check.C) { func (s *DockerSuite) TestRunContainerWithReadonlyRootfs(c *check.C) { testRequires(c, NativeExecDriver) - for _, f := range []string{"/file", "/etc/hosts", "/etc/resolv.conf", "/etc/hostname", "/proc/uptime", "/sys/kernel", "/dev/.dont.touch.me"} { + for _, f := range []string{"/file", "/etc/hosts", "/etc/resolv.conf", "/etc/hostname", "/sys/kernel", "/dev/.dont.touch.me"} { testReadOnlyFile(f, c) } }