diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-08-03 19:18:53 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-03 19:18:53 +0900 |
| commit | 38245559dca0833dc078b982d59490eee53e168c (patch) | |
| tree | ffe415b5db8fd21b3a75600428f167eeef018591 /internal/app/app_pd_linux_test.go | |
| parent | 7b416d47dcb830aab5daa432cf79af5f8bbacaef (diff) | |
container/ops: mount dev readonly
There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/app/app_pd_linux_test.go')
| -rw-r--r-- | internal/app/app_pd_linux_test.go | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/internal/app/app_pd_linux_test.go b/internal/app/app_pd_linux_test.go index b3d03f03..31a99f87 100644 --- a/internal/app/app_pd_linux_test.go +++ b/internal/app/app_pd_linux_test.go @@ -46,12 +46,13 @@ var testCasesPd = []sealTestCase{ Root("/", "4a450b6596d7bc15bd01780eb9a607ac", container.BindWritable). Proc("/proc"). Tmpfs(hst.Tmp, 4096, 0755). - Dev("/dev", true). + DevWritable("/dev", true). Bind("/dev/kvm", "/dev/kvm", container.BindWritable|container.BindDevice|container.BindOptional). Readonly("/var/run/nscd", 0755). Tmpfs("/run/user/1971", 8192, 0755). Tmpfs("/run/dbus", 8192, 0755). Etc("/etc", "4a450b6596d7bc15bd01780eb9a607ac"). + Remount("/dev", syscall.MS_RDONLY). Tmpfs("/run/user", 4096, 0755). Bind("/tmp/hakurei.1971/runtime/0", "/run/user/65534", container.BindWritable). Bind("/tmp/hakurei.1971/tmpdir/0", "/tmp", container.BindWritable). @@ -180,13 +181,14 @@ var testCasesPd = []sealTestCase{ Root("/", "ebf083d1b175911782d413369b64ce7c", container.BindWritable). Proc("/proc"). Tmpfs(hst.Tmp, 4096, 0755). - Dev("/dev", true). + DevWritable("/dev", true). Bind("/dev/dri", "/dev/dri", container.BindWritable|container.BindDevice|container.BindOptional). Bind("/dev/kvm", "/dev/kvm", container.BindWritable|container.BindDevice|container.BindOptional). Readonly("/var/run/nscd", 0755). Tmpfs("/run/user/1971", 8192, 0755). Tmpfs("/run/dbus", 8192, 0755). Etc("/etc", "ebf083d1b175911782d413369b64ce7c"). + Remount("/dev", syscall.MS_RDONLY). Tmpfs("/run/user", 4096, 0755). Bind("/tmp/hakurei.1971/runtime/9", "/run/user/65534", container.BindWritable). Bind("/tmp/hakurei.1971/tmpdir/9", "/tmp", container.BindWritable). |