Runc should remount binds with correct options.

[vinayakankugoyal]

When user namespaces (userns) feature is enabled and a bind mount is created from the host to container, and the host filesystem where this files lives on the host is mounted with nosuid, nodev, noexec the bind mount will fail in the container if containerd doesn't have those options aswell.

We discovered this issue while debugging #3770. We fixed this issue in containerd via containerd/containerd#8309, however we would like to discuss if runc should implement remounting with the correct options in this case. As @rata pointed out in #3770 (comment): Crun already does this https://github.com/containers/crun/blob/main/src/libcrun/linux.c#L919-L946.

Here is an example:-

On Google COS OS.

/etc/resolv.conf is a symlink to/run/systemd/resolve/resolv.conf

ls -la /etc/resolv.conf 
lrwxrwxrwx 1 root root 32 Jan 21 10:34 /etc/resolv.conf -> /run/systemd/resolve/resolv.conf

If we look at the filesystem mount for /run

mount | grep run
tmpfs on /run type tmpfs (rw,nosuid,nodev,size=804604k,nr_inodes=819200,mode=755)

Without our fix above the runtime config (config.json) the bind mount for /etc/resolv.conf was specified as :-

{
   "destination": "/etc/resolv.conf",
   "type": "bind",
   "source": "/etc/resolv.conf",
   "options": [
     "rbind",
     "ro"
   ]
}

This error looks like

ERRO[0000]utils.go:61 main.fatalWithCode() runc run failed: unable to start container process: error during container init: error mounting "/etc/resolv.conf" to rootfs at "/etc/resolv.conf": mount /proc/self/fd/7:/etc/resolv.conf (via /proc/self/fd/8), flags: 0x5021: operation not permitted

We fixed this by updating the options to add nosuid, noexec, nodev to the options.

{
  "destination": "/etc/resolv.conf",
  "type": "bind",
  "source": "/etc/resolv.conf",
  "options": [
    "rbind",
    "ro",
    "nosuid",
    "nodev",
    "noexec"
  ]
}

Not that just adding nosuid, nodev would also have worked because those were the options specified in the tmpfs on /run on the host.

[vinayakankugoyal]

/cc @rata

[AkihiroSuda]

I think we discussed this before in somewhere, and we wanted high-level runtimes to generate the proper config.

[kolyshkin]

In an ideal world, yes.

Practically, though, I think there is nothing wrong for runc to automatically copy some restrictive options (like ro or nodev) from the original mount and apply those to the bind mount requested. It simplifies things without introducing complications. Besides, crun is doing it, and we don't want a "works with crun but not runc" situation.

[rata]

Ok, and we already have a PR for that: #3805

Shall we also modify the runtime-spec to mention that in case of failure runtimes MAY retry mounts with these flags?

[rata]

@vinayakankugoyal the mount of /run is not really relevant, because you manually modified the config.json and nothing is really mounting from there. But the mount option of /var/ is what is relevant, and I assume it has the same nosuid, nodev, noexec options.

@AkihiroSuda Cool, if there is agreement on that, we can close this discussion :)

[vinayakankugoyal]

It is relevant to the config that I used in the example. If I was using a standard containerd config under lets say /var/run/containerd then /var would be relevant. What I was trying to say was that the options have to match the options used by to mount the filesystem on the host.