X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=src%2Fsecure-mount.c;h=6dc2c41851a0ce121a0299cbbaa2d7757ad3bf16;hb=5817e191c23c4c53548472b5aa77a29d995c3410;hp=87cc596f94a360c645c536c2dc29d80c3146e9fa;hpb=517fb954f46091a78f471435b7f284668138a2da;p=util-vserver.git diff --git a/src/secure-mount.c b/src/secure-mount.c index 87cc596..6dc2c41 100644 --- a/src/secure-mount.c +++ b/src/secure-mount.c @@ -70,6 +70,7 @@ struct MountInfo { unsigned long xflag; unsigned long mask; char * data; + char * data_parsed; }; struct Options { @@ -121,7 +122,7 @@ static struct FstabOption { unsigned long const xflag; bool const is_dflt; } const FSTAB_OPTIONS[] = { - { "defaults", 0, (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC| + { "defaults", MS_NODEV, (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC| MS_SYNCHRONOUS), 0, false }, { "rbind", MS_BIND|MS_REC, MS_BIND|MS_REC, 0, false }, { "bind", MS_BIND, MS_BIND, 0, false }, @@ -278,8 +279,8 @@ updateMtab(struct MountInfo const *mnt, struct Options const *opt) goto err0; } - if (flock(fd, LOCK_EX)==-1) { - perror("secure-mount: flock()"); + if (lockf(fd, F_LOCK, 0)==-1) { + perror("secure-mount: lockf()"); goto err1; } @@ -431,10 +432,24 @@ mountSingle(struct MountInfo const *mnt, struct Options const *opt) if (canHandleInternal(mnt)) { if (mount(mnt->src, ".", mnt->type ? mnt->type : "", - mnt->flag, mnt->data)==-1) { + mnt->flag, mnt->data_parsed)==-1) { perror("secure-mount: mount()"); return false; } + if ((mnt->flag & MS_BIND) && + (mnt->flag & ~(MS_BIND|MS_REC))) { + /* This is needed to put us in the new mountpoint */ + if (!secureChdir(mnt->dst, opt)) + return false; + if (mount(mnt->src, ".", + mnt->type ? mnt->type : "", + ((mnt->flag & ~(MS_BIND|MS_REC)) | + MS_REMOUNT), NULL) == -1 && + errno != EBUSY) { /* Returned on older kernels */ + perror("secure-mount: mount()"); + return false; + } + } } else if (!callExternalMount(mnt)) return false; @@ -493,7 +508,7 @@ transformOptionList(struct MountInfo *info, size_t UNUSED *col) } while (*ptr!='\0'); - info->data = data; + info->data_parsed = data; return true; }