From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 12 Apr 2012 10:58:08 +0000 (+0200)
Subject: nspawn: bind mount /dev/nul to /proc/kmsg, so that the container can't muck with... 
X-Git-Tag: v183~375
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=68fb08920b2162b48cf0fa8dd98b021327b42896

nspawn: bind mount /dev/nul to /proc/kmsg, so that the container can't muck with the host kmsg
---

diff --git a/src/nspawn.c b/src/nspawn.c
index 7b65e9853..685b4d4e5 100644
--- a/src/nspawn.c
+++ b/src/nspawn.c
@@ -184,7 +184,8 @@ static int mount_all(const char *dest) {
                         break;
                 }
 
-                if ((t = path_is_mount_point(where, false)) < 0) {
+                t = path_is_mount_point(where, false);
+                if (t < 0) {
                         log_error("Failed to detect whether %s is a mount point: %s", where, strerror(-t));
                         free(where);
 
@@ -229,6 +230,11 @@ static int mount_all(const char *dest) {
                 free(where);
         }
 
+        if (asprintf(&where, "%s/proc/kmsg", dest) >= 0) {
+                mount("/dev/null", where, "bind", MS_BIND, NULL);
+                free(where);
+        }
+
         return r;
 }