jail: only mess with rootfs if CLONE_NEWNS was set
authorDaniel Golle <daniel@makrotopia.org>
Sun, 12 Apr 2020 14:51:49 +0000 (15:51 +0100)
committerDaniel Golle <daniel@makrotopia.org>
Sun, 12 Apr 2020 18:51:50 +0000 (19:51 +0100)
Avoid messing up rootfs of the parent/only mount namespace for the
unusual case of a jailed process which does use namespaces, but
doesn't make use of mount namespaces.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
jail/jail.c

index ec106d27147161f70d9ab6b098fe1fcebcf1837a..fa8da01435419aac2397b7d8dd19c0a3b41d2dee 100644 (file)
@@ -502,7 +502,7 @@ static int exec_jail(void *pipes_ptr)
                exit(EXIT_FAILURE);
        }
 
-       if (opts.namespace && build_jail_fs()) {
+       if ((opts.namespace & CLONE_NEWNS) && build_jail_fs()) {
                ERROR("failed to build jail fs\n");
                exit(EXIT_FAILURE);
        }