From 67399c6279d7c2777a1a83103644f853d87533ba Mon Sep 17 00:00:00 2001 From: "Ronald G. Minnich" Date: Mon, 24 Apr 2017 16:09:24 -0700 Subject: syscall: fix ordering of Unshare and chroot on Linux When unshare specifies a new namespace, the syscall package changes / to make namespace changes private. If a chroot is specified, the unshare must be done first. If the chroot is done first then the unshare will not specify the correct /. A new test is included which test combining chroot and CLONE_NEWNS; it fails without the patch and works with it. Fixes #20103 Change-Id: I86022803c784bd418a30383321f3d64103d95c62 Reviewed-on: https://go-review.googlesource.com/41626 Reviewed-by: Ian Lance Taylor Run-TryBot: Ian Lance Taylor TryBot-Result: Gobot Gobot --- src/syscall/exec_linux.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'src/syscall/exec_linux.go') diff --git a/src/syscall/exec_linux.go b/src/syscall/exec_linux.go index e35ac25580..66fb0356ba 100644 --- a/src/syscall/exec_linux.go +++ b/src/syscall/exec_linux.go @@ -195,14 +195,6 @@ func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr } } - // Chroot - if chroot != nil { - _, _, err1 = RawSyscall(SYS_CHROOT, uintptr(unsafe.Pointer(chroot)), 0, 0) - if err1 != 0 { - goto childerror - } - } - // Unshare if sys.Unshareflags != 0 { _, _, err1 = RawSyscall(SYS_UNSHARE, sys.Unshareflags, 0, 0) @@ -224,6 +216,14 @@ func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr } } + // Chroot + if chroot != nil { + _, _, err1 = RawSyscall(SYS_CHROOT, uintptr(unsafe.Pointer(chroot)), 0, 0) + if err1 != 0 { + goto childerror + } + } + // User and groups if cred := sys.Credential; cred != nil { ngroups := uintptr(len(cred.Groups)) -- cgit v1.3-5-g45d5