[libvirt] [PATCH 2/2] LXC: make sure netns been enabled when trying to enable userns
Discussed at:
http://www.redhat.com/archives/libvir-list/2015-March/msg01023.html
Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com>
---
src/lxc/lxc_container.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
index e34968a..69a8f2f 100644
--- a/src/lxc/lxc_container.c
+++ b/src/lxc/lxc_container.c
@@ -941,6 +941,16 @@ static int lxcContainerMountBasicFS(bool userns_enabled,
bool bindOverReadonly;
virLXCBasicMountInfo const *mnt = &lxcBasicMounts[i];
+ /* When enable userns but disable netns, kernel will
+ * forbid us doing a new fresh mount for sysfs for security reason.
+ * So we should not allow this.
+ */
+ if (userns_enabled && netns_disabled) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("Userns could not be enabled without netns"));
+ goto cleanup;
+ }
+
VIR_DEBUG("Processing %s -> %s",
mnt->src, mnt->dst);
--
2.1.0