X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fcore%2Fmount-setup.c;h=ae8447ca4df951d386ea2a1cccec82a3b1adc83a;hb=be8f4e9e8eb3b0c34a49c2e80a5c5b7dc6d175f0;hp=c6d3f4bbcc7142d6b41c9d6647762caf04028e4b;hpb=a641dcd9bf05418d6a6c165e1c0cff615b4a0f47;p=elogind.git

diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c
index c6d3f4bbc..ae8447ca4 100644
--- a/src/core/mount-setup.c
+++ b/src/core/mount-setup.c
@@ -92,13 +92,11 @@ static const MountPoint mount_table[] = {
         { "tmpfs",      "/run",                      "tmpfs",      "mode=755", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "tmpfs",      "/sys/fs/cgroup",            "tmpfs",      "mode=755", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
-          NULL,       MNT_IN_CONTAINER },
-#ifdef HAVE_XATTR
+          NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd,xattr", MS_NOSUID|MS_NOEXEC|MS_NODEV,
-          NULL,       MNT_IN_CONTAINER },
-#endif
+          NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "cgroup",     "/sys/fs/cgroup/systemd",    "cgroup",     "none,name=systemd", MS_NOSUID|MS_NOEXEC|MS_NODEV,
-          NULL,       MNT_IN_CONTAINER },
+          NULL,       MNT_FATAL|MNT_IN_CONTAINER },
         { "pstore",     "/sys/fs/pstore",            "pstore",     NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
           NULL,       MNT_NONE },
 #ifdef ENABLE_EFI
@@ -172,7 +170,10 @@ static int mount_one(const MountPoint *p, bool relabel) {
 
         /* The access mode here doesn't really matter too much, since
          * the mounted file system will take precedence anyway. */
-        mkdir_p_label(p->where, 0755);
+        if (relabel)
+                mkdir_p_label(p->where, 0755);
+        else
+                mkdir_p(p->where, 0755);
 
         log_debug("Mounting %s to %s of type %s with options %s.",
                   p->what,
@@ -185,7 +186,7 @@ static int mount_one(const MountPoint *p, bool relabel) {
                   p->type,
                   p->flags,
                   p->options) < 0) {
-                log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s: %m", p->where);
+                log_full((p->mode & MNT_FATAL) ? LOG_ERR : LOG_DEBUG, "Failed to mount %s at %s: %m", p->type, p->where);
                 return (p->mode & MNT_FATAL) ? -errno : 0;
         }
 
@@ -338,6 +339,10 @@ int mount_cgroup_controllers(char ***join_controllers) {
                 }
         }
 
+        /* Now that we mounted everything, let's make the tmpfs the
+         * cgroup file systems are mounted into read-only. */
+        mount("tmpfs", "/sys/fs/cgroup", "tmpfs", MS_REMOUNT|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME|MS_RDONLY, "mode=755");
+
         return 0;
 }