From b76b6b9338917bcdb258d512a582d613a477e58d Mon Sep 17 00:00:00 2001 From: Irwin D'Souza Date: Thu, 7 Apr 2022 14:08:59 -0400 Subject: [PATCH] Allow mounting of /proc/sys/kernel/ns_last_pid The CAP_CHECKPOINT_RESTORE linux capability provides the ability to update /proc/sys/kernel/ns_last_pid. However, because this file is under /proc, and by default both K8s and CRI-O specify that /proc/sys should be mounted as Read-Only, by default even with the capability specified, a process will not be able to write to ns_last_pid. To get around this, a pod author can specify a volume mount and a hostpath to bind-mount /proc/sys/kernel/ns_last_pid. However, runc does not allow specifying mounts under /proc. This commit adds /proc/sys/kernel/ns_last_pid to the validProcMounts string array to enable a pod author to mount ns_last_pid as read-write. The default remains unchanged; unless explicitly requested as a volume mount, ns_last_pid will remain read-only regardless of whether or not CAP_CHECKPOINT_RESTORE is specified. Signed-off-by: Irwin D'Souza --- libcontainer/rootfs_linux.go | 1 + libcontainer/rootfs_linux_test.go | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 5290a45ec73..e8d8211b198 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -554,6 +554,7 @@ func checkProcMount(rootfs, dest, source string) error { "/proc/loadavg", "/proc/slabinfo", "/proc/net/dev", + "/proc/sys/kernel/ns_last_pid", } for _, valid := range validProcMounts { path, err := filepath.Rel(filepath.Join(rootfs, valid), dest) diff --git a/libcontainer/rootfs_linux_test.go b/libcontainer/rootfs_linux_test.go index e3bfdc50315..8709a5e47f7 100644 --- a/libcontainer/rootfs_linux_test.go +++ b/libcontainer/rootfs_linux_test.go @@ -38,6 +38,14 @@ func TestCheckMountDestFalsePositive(t *testing.T) { } } +func TestCheckMountDestNsLastPid(t *testing.T) { + dest := "/rootfs/proc/sys/kernel/ns_last_pid" + err := checkProcMount("/rootfs", dest, "/proc") + if err != nil { + t.Fatal("/proc/sys/kernel/ns_last_pid should not return an error") + } +} + func TestNeedsSetupDev(t *testing.T) { config := &configs.Config{ Mounts: []*configs.Mount{