From 32c717e18ee3f73a68ac854cfc5ba9e7cbf8c3b1 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Sun, 12 Apr 2020 15:51:49 +0100 Subject: [PATCH] jail: only mess with rootfs if CLONE_NEWNS was set Avoid messing up rootfs of the parent/only mount namespace for the unusual case of a jailed process which does use namespaces, but doesn't make use of mount namespaces. Signed-off-by: Daniel Golle --- jail/jail.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jail/jail.c b/jail/jail.c index ec106d2..fa8da01 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -502,7 +502,7 @@ static int exec_jail(void *pipes_ptr) exit(EXIT_FAILURE); } - if (opts.namespace && build_jail_fs()) { + if ((opts.namespace & CLONE_NEWNS) && build_jail_fs()) { ERROR("failed to build jail fs\n"); exit(EXIT_FAILURE); } -- 2.25.1