feature: Support atomfs molecule mount in containers #359
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
smoser
requested changes
Dec 13, 2022
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
from
2187eb3
to
a427449
Compare
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
4 times, most recently
from
a7eef77
to
88b0636
Compare
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
from
88b0636
to
58619a0
Compare
|
Slated for v0.40.2 |
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
from
58619a0
to
3772b11
Compare
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
from
3772b11
to
d061e11
Compare
Signed-off-by: Serge Hallyn <serge@hallyn.com>
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
from
d061e11
to
28cd3d9
Compare
That is wrong guidance. I see that it's hardcoded in test/static-analysis.sh, but as I don't have my nitrokey with me I can't append a patch to this PR to remove it. |
smoser
reviewed
Dec 20, 2022
smoser
reviewed
Dec 20, 2022
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
2 times, most recently
from
18b73d1
to
e472442
Compare
Oh - that's what I ended up doing. |
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
2 times, most recently
from
1e4402e
to
30968be
Compare
smoser
reviewed
Dec 21, 2022
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
2 times, most recently
from
49f9503
to
a86d7aa
Compare
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
from
2e7e447
to
3d1bf2a
Compare
While stacker knows how to use squashfuse for 'stacker grab', that function simply keeps the squashfuse process running for the duration of the grab, then lets it close. For atomfs molecule.Mount, we must release that process. So when doing atomfs.Mount(), first check whether we are definitely NOT root using amHostRoot(). There is a corner case which can slip past this - namely if you, as root, create a userns wherein you map the full host uid range. However, you'll never have real root being told it wasn't real root. Second, if neither of those are the case, then try the regular mount syscall, requiring root. If that succeeds, or fails with a non-permission error, then return. If we are detected as not-real-root, or if mount failed as real root with a permission error, and no verity root has was provided, then use squashfuse, and release the exec'd process so that it can outlive us. The actual squashfuse mount function is shared with the extract path. Signed-off-by: Serge Hallyn <serge@hallyn.com>
hallyn
force-pushed
the
2022-12-11/mol-fuse
branch
from
3d1bf2a
to
6a64317
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Support mounting atomfs stacks as root in a container.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.