fix: change the propagation type of the root mount to shared#1686
fix: change the propagation type of the root mount to shared#1686reddevillg wants to merge 1 commit into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a mount system call in runInNamespaceEntry to set the propagation type of the root directory to shared, along with the necessary header inclusion. The review feedback correctly points out that the return value of the mount call should be checked and handled to avoid silent failures if the operation fails.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
The mount propagation type will be private,slave if a new mount namespace is creted by clone() and CLONE_NEWUSER is also used. Change it to shared,slave. Signed-off-by: reddevillg <reddevillg@gmail.com>
reddevillg
force-pushed
the
fix_propagation
branch
from
3e859a5 to
fbbd926
Compare
deepin pr auto review★ 总体评分：20分■ 【总体评价】
■ 【详细分析】
■ 【改进建议代码示例】 diff --git a/libs/utils/src/linglong/utils/namespace.cpp b/libs/utils/src/linglong/utils/namespace.cpp
index 463bce464..123456789 100644
--- a/libs/utils/src/linglong/utils/namespace.cpp
+++ b/libs/utils/src/linglong/utils/namespace.cpp
@@ -313,8 +313,9 @@ int runInNamespaceEntry(void *args)
}
}
- if (mount("", "/", "", MS_SHARED | MS_REC, NULL) == -1) {
- LogW("failed to change propagation type of / to shared: {}",
+ // 使用 MS_PRIVATE 确保容器挂载事件不会泄漏到宿主机，保障命名空间隔离安全
+ if (mount("", "/", "", MS_PRIVATE | MS_REC, NULL) == -1) {
+ LogW("failed to change propagation type of / to private: {}",
common::error::errorString(errno));
}
|
|
@reddevillg: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Codecov Report❌ Patch coverage is
🚀 New features to boost your workflow:
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dengbo11, reddevillg The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
3 participants
The mount propagation type will be private,slave if a new mount namespace is creted by clone() and CLONE_NEWUSER is also used. Change it to shared,slave.