Re: [libvirt] [PATCH 3/3] Honour filesystem readonly flag & make special FS readonly

From: "Daniel P. Berrange"<berrange(a)redhat.com> A container should not be allowed to modify stuff in /sys or /proc/sys so make them readonly. Make /selinux readonly so that containers think that selinux is disabled.

Honour the readonly flag when mounting container filesystems from the guest XML config * src/lxc/lxc_container.c: Support readonly mounts --- src/lxc/lxc_container.c | 29 +++++++++++++++++++++++++++++ 1 files changed, 29 insertions(+), 0 deletions(-) } mnts[] = { + /* When we want to make a bind mount readonly, for unknown reasons, + * it is currently neccessary to bind it once, and then remount the

+ * bind with the readonly flag. If this is not done, then the original + * mount point in the main OS becomes readonly too which si not what