mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
Prevent mqueue from implicitely becoming a bind mount with --ipc=host
Currently, when running a container with --ipc=host, if /dev/mqueue is a standard directory on the hos the daemon will bind mount it allowing the container to create/modify files on the host. This commit forces /dev/mqueue to always be of type mqueue except when the user explicitely requested something to be bind mounted to /dev/mqueue. Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
This commit is contained in:
parent
fa860c86ff
commit
f7d4abdc00
3 changed files with 21 additions and 16 deletions
|
@ -44,7 +44,6 @@ type Container struct {
|
|||
HostnamePath string
|
||||
HostsPath string
|
||||
ShmPath string
|
||||
MqueuePath string
|
||||
ResolvConfPath string
|
||||
SeccompProfile string
|
||||
}
|
||||
|
@ -577,15 +576,6 @@ func (container *Container) IpcMounts() []execdriver.Mount {
|
|||
Propagation: volume.DefaultPropagationMode,
|
||||
})
|
||||
}
|
||||
if !container.HasMountFor("/dev/mqueue") &&
|
||||
container.MqueuePath != "" {
|
||||
mounts = append(mounts, execdriver.Mount{
|
||||
Source: container.MqueuePath,
|
||||
Destination: "/dev/mqueue",
|
||||
Writable: true,
|
||||
Propagation: volume.DefaultPropagationMode,
|
||||
})
|
||||
}
|
||||
return mounts
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue