Pass linux_masked_paths

README.md

@@ -48,7 +48,7 @@ youki is not at the practical stage yet. However, it is getting closer to practi
 |    Seccomp     |             Filtering system calls              |                     WIP on [#25](https://github.com/containers/youki/issues/25)                     |
 |     Hooks      | Add custom processing during container creation |                                                  ✅                                                  |
 |    Rootless    |   Running a container without root privileges   | It works, but cgroups isn't supported. WIP on [#77](https://github.com/containers/youki/issues/77)  |
-| OCI Compliance |        Compliance with OCI Runtime Spec         |                                   46 out of 55 test cases passing                                   |
+| OCI Compliance |        Compliance with OCI Runtime Spec         |                                   47 out of 55 test cases passing                                   |
 
 # Design and implementation of youki
 ![sequence diagram of youki](docs/.drawio.svg)

integration_test.sh

@@ -37,7 +37,7 @@ test_cases=(
   "linux_cgroups_relative_network/linux_cgroups_relative_network.t"
   "linux_cgroups_relative_pids/linux_cgroups_relative_pids.t"
   "linux_devices/linux_devices.t"
-  # "linux_masked_paths/linux_masked_paths.t"
+  "linux_masked_paths/linux_masked_paths.t"
   "linux_mount_label/linux_mount_label.t"
   # This test case hangs on the Github Action. Runtime-tools has an issue filed from 2019 that the clean up step hangs. Otherwise, the test case passes.
   # Ref: https://github.com/opencontainers/runtime-tools/issues/698

src/process/init.rs

@@ -148,6 +148,40 @@ fn readonly_path(path: &str) -> Result<()> {
     Ok(())
 }
 
+// For files, bind mounts /dev/null over the top of the specified path.
+// For directories, mounts read-only tmpfs over the top of the specified path.
+fn masked_path(path: &str, mount_label: &Option<String>) -> Result<()> {
+    match nix_mount::<str, str, str, str>(
+        Some("/dev/null"),
+        path,
+        None::<&str>,
+        MsFlags::MS_BIND,
+        None::<&str>,
+    ) {
+        // ignore error if path is not exist.
+        Err(nix::errno::Errno::ENOENT) => {
+            log::warn!("masked path {:?} not exist", path);
+            return Ok(());
+        }
+        Err(nix::errno::Errno::ENOTDIR) => {
+            let label = match mount_label {
+                Some(l) => format!("context={}", l),
+                None => "".to_string(),
+            };
+            let _ = nix_mount(
+                Some("tmpfs"),
+                path,
+                Some("tmpfs"),
+                MsFlags::MS_RDONLY,
+                Some(label.as_str()),
+            );
+        }
+        Err(err) => bail!(err),
+        Ok(_) => {}
+    };
+    Ok(())
+}
+
 pub struct ContainerInitArgs<'a> {
     /// Flag indicating if an init or a tenant container should be created
     pub init: bool,
@@ -355,6 +389,13 @@ pub fn container_init(
         }
     }
 
+    if let Some(paths) = &linux.masked_paths {
+        // mount masked path
+        for path in paths {
+            masked_path(path, &linux.mount_label).context("Failed to set masked path")?;
+        }
+    }
+
     let do_chdir = if proc.cwd.is_empty() {
         false
     } else {