From 5bc5326a6b721ba346d017f90ca4e8b6d097a773 Mon Sep 17 00:00:00 2001 From: Simon McVittie <smcv@collabora.com> Date: Thu, 22 Jul 2021 11:39:09 +0100 Subject: [PATCH] runtime: Adjust fallback behaviour when taking files from provider Previously, we assumed that if OS files on the provider are in a location that is not /usr or a related directory, for example if the OS has /lib/ld-linux.so.2 -> /some/odd/path/i386/ld.so, then they will appear below the same path_in_container_ns as /usr, for example /run/host/some/odd/path/i386/ld.so. However, nothing sets this up for directories other than /usr, /lib*, /bin, /sbin and /etc, so it's a bad assumption. A previous commit handled /etc by redirecting it to /run/host/etc, /run/parent/etc or /run/gfx/etc as appropriate, so we don't need to worry about that here. For the rest, assume that if they appear in the container at all, they'll appear at a path that matches their location in the provider. For the common case where provider = host, which is the only one where we really need to support non-FHS layouts, this means that users can work around lack of explicit support for a particular non-FHS directory with something like PRESSURE_VESSEL_FILESYSTEMS_RO=/some/odd/path. In particular, if we didn't have explicit support for /nix, NixOS users would have been able to use that workaround to get it mounted. Signed-off-by: Simon McVittie <smcv@collabora.com> --- pressure-vessel/runtime.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/pressure-vessel/runtime.c b/pressure-vessel/runtime.c index 7cce3f4a3..fdc5b1040 100644 --- a/pressure-vessel/runtime.c +++ b/pressure-vessel/runtime.c @@ -3003,10 +3003,16 @@ pv_runtime_take_from_provider (PvRuntime *self, g_warning ("\"%s\" is unlikely to appear in \"%s\"", source_in_provider, self->provider->path_in_container_ns); - /* ... but try it anyway, it can't hurt. - * TODO: Is "/" more likely to work than "/run/host" here? */ - target = g_build_filename (self->provider->path_in_container_ns, - source_in_provider, NULL); + /* We might as well try *something*. + * path_visible_in_provider_namespace() covers all the paths + * that are going to appear in /run/host or similar, so try with + * no special prefix here, as though + * path_visible_in_container_namespace() had returned true: + * that way, even if we're on a non-FHS distro that puts + * ld.so in /some/odd/path, it will be possible to use + * PRESSURE_VESSEL_FILESYSTEMS_RO=/some/odd/path + * as a workaround until pressure-vessel can be adjusted. */ + target = g_build_filename ("/", source_in_provider, NULL); } g_return_val_if_fail (target != NULL, FALSE); -- GitLab