summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHelmut Grohne <helmut@subdivi.de>2024-04-04 10:59:22 +0200
committerHelmut Grohne <helmut@subdivi.de>2024-04-04 10:59:22 +0200
commit48f9486a2daa1e43f13dc87e71ddc7e0e63ba7c2 (patch)
tree399795a1316f2e8600ee515761886fc9f964e480
parent4b6414079b074ec2a914f2e6a0fdb47916453f78 (diff)
downloadpython-linuxnamespaces-48f9486a2daa1e43f13dc87e71ddc7e0e63ba7c2.tar.gz
add function populate_proc
-rw-r--r--linuxnamespaces/__init__.py39
1 files changed, 39 insertions, 0 deletions
diff --git a/linuxnamespaces/__init__.py b/linuxnamespaces/__init__.py
index 2b92462..e305b4e 100644
--- a/linuxnamespaces/__init__.py
+++ b/linuxnamespaces/__init__.py
@@ -426,6 +426,45 @@ def populate_dev(
move_mount(fd, newdev / fn)
+def populate_proc(
+ origroot: AtLocationLike,
+ newroot: PathConvertible,
+ namespaces: CloneFlags,
+) -> None:
+ """Mount a /proc hierarchy.
+
+ Note that a user with CAP_SYS_ADMIN can change read-only bind mounts.
+ Still those bind mounts provide guidance to the container as to which
+ aspects it should manage.
+ """
+ assert namespaces & CloneFlags.NEWNS == CloneFlags.NEWNS
+ newproc = AtLocation(newroot) / "proc"
+ rwns = CloneFlags.NEWPID
+ if namespaces & rwns == rwns:
+ mount(
+ "proc",
+ newproc,
+ "proc",
+ MountFlags.NOSUID | MountFlags.NODEV | MountFlags.NOEXEC,
+ )
+ else:
+ bind_mount(AtLocation(origroot) / "proc", newproc, True)
+ with _ExceptionExitCallback(umount, newproc, UmountFlags.DETACH):
+ rwns |= CloneFlags.NEWUSER | CloneFlags.NEWIPC | CloneFlags.NEWUTS
+ if namespaces & rwns != rwns:
+ psn: AtLocation | None = None
+ if namespaces & CloneFlags.NEWNET == CloneFlags.NEWNET:
+ psn = open_tree(
+ newproc / "sys/net",
+ OpenTreeFlags.OPEN_TREE_CLONE | OpenTreeFlags.AT_RECURSIVE,
+ )
+ bind_mount(newproc / "sys", newproc / "sys", True, True)
+ if psn is not None:
+ move_mount(psn, newproc / "sys/net")
+ elif namespaces & CloneFlags.NEWNET != CloneFlags.NEWNET:
+ bind_mount(newproc / "sys/net", newproc / "sys/net", True, True)
+
+
def populate_sys(
origroot: AtLocationLike,
newroot: PathConvertible,