1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00

Prevent mqueue from implicitely becoming a bind mount with --ipc=host

Currently, when running a container with --ipc=host, if /dev/mqueue is
a standard directory on the hos the daemon will bind mount it allowing
the container to create/modify files on the host.

This commit forces /dev/mqueue to always be of type mqueue except when
the user explicitely requested something to be bind mounted to
/dev/mqueue.

Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
This commit is contained in:
Kenfe-Mickael Laventure 2016-02-08 16:51:45 -08:00
parent fa860c86ff
commit f7d4abdc00
3 changed files with 21 additions and 16 deletions

View file

@ -44,7 +44,6 @@ type Container struct {
HostnamePath string
HostsPath string
ShmPath string
MqueuePath string
ResolvConfPath string
SeccompProfile string
}
@ -577,15 +576,6 @@ func (container *Container) IpcMounts() []execdriver.Mount {
Propagation: volume.DefaultPropagationMode,
})
}
if !container.HasMountFor("/dev/mqueue") &&
container.MqueuePath != "" {
mounts = append(mounts, execdriver.Mount{
Source: container.MqueuePath,
Destination: "/dev/mqueue",
Writable: true,
Propagation: volume.DefaultPropagationMode,
})
}
return mounts
}