On 05/10/2012 10:17 AM, Daniel P. Berrange wrote: > From: "Daniel P. Berrange" <[email protected]> > > Currently to make sysfs readonly, we remount the existing > instance and then bind it readonly. Unfortunately this means > sysfs is still showing device objects wrt the host OS namespace. > We need it to reflect the container namespace, so we must mount > a completely new instance of it. > > * src/lxc/lxc_container.c: Mount fresh sysfs instance > --- > src/lxc/lxc_container.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c > index b953646..77d33e1 100644 > --- a/src/lxc/lxc_container.c > +++ b/src/lxc/lxc_container.c > @@ -441,8 +441,7 @@ static int lxcContainerMountBasicFS(lxc_child_argv_t > *argv, const char *srcprefi > { false, "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV > }, > { false, "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND }, > { false, "/proc/sys", "/proc/sys", NULL, NULL, > MS_BIND|MS_REMOUNT|MS_RDONLY }, > - { true, "/sys", "/sys", NULL, NULL, MS_BIND }, > - { true, "/sys", "/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, > + { false, "sysfs", "/sys", "sysfs", NULL, > MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY },
ACK. -- Eric Blake [email protected] +1-919-301-3266 Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/libvir-list
