Skip to content

Commit c286afc

Browse files
committed
WIP allow chroot instead of pivot_root
TODO: make this configurable or make it a fallback pivot_root is not allowed in containers
1 parent 225ea6d commit c286afc

File tree

1 file changed

+3
-20
lines changed

1 file changed

+3
-20
lines changed

src/libstore/build.cc

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2616,11 +2616,6 @@ void DerivationGoal::runChild()
26162616
throw SysError("unable to make '/' private mount");
26172617
}
26182618

2619-
/* Bind-mount chroot directory to itself, to treat it as a
2620-
different filesystem from /, as needed for pivot_root. */
2621-
if (mount(chrootRootDir.c_str(), chrootRootDir.c_str(), 0, MS_BIND, 0) == -1)
2622-
throw SysError(format("unable to bind mount '%1%'") % chrootRootDir);
2623-
26242619
/* Set up a nearly empty /dev, unless the user asked to
26252620
bind-mount the host /dev. */
26262621
Strings ss;
@@ -2724,23 +2719,11 @@ void DerivationGoal::runChild()
27242719
}
27252720

27262721
/* Do the chroot(). */
2727-
if (chdir(chrootRootDir.c_str()) == -1)
2728-
throw SysError(format("cannot change directory to '%1%'") % chrootRootDir);
2729-
2730-
if (mkdir("real-root", 0) == -1)
2731-
throw SysError("cannot create real-root directory");
2732-
2733-
if (pivot_root(".", "real-root") == -1)
2734-
throw SysError(format("cannot pivot old root directory onto '%1%'") % (chrootRootDir + "/real-root"));
2735-
2736-
if (chroot(".") == -1)
2722+
if (chroot(chrootRootDir.c_str()) == -1)
27372723
throw SysError(format("cannot change root directory to '%1%'") % chrootRootDir);
27382724

2739-
if (umount2("real-root", MNT_DETACH) == -1)
2740-
throw SysError("cannot unmount real root filesystem");
2741-
2742-
if (rmdir("real-root") == -1)
2743-
throw SysError("cannot remove real-root directory");
2725+
if (chdir("/") == -1)
2726+
throw SysError(format("cannot change directory to '/'") % chrootRootDir);
27442727

27452728
/* Switch to the sandbox uid/gid in the user namespace,
27462729
which corresponds to the build user or calling user in

0 commit comments

Comments
 (0)