~ruther/guix-local

842e0e439a22081be1b4fed7ddc21d6d228afd10 — Jörg Thalheim 9 years ago 2559401
Simplify remouting with MS_PRIVATE in sandbox build

also fix race condition if mounts are added after mountinfo is read.
1 files changed, 2 insertions(+), 6 deletions(-)

M nix/libstore/build.cc
M nix/libstore/build.cc => nix/libstore/build.cc +2 -6
@@ 2086,12 2086,8 @@ void DerivationGoal::runChild()
               outside of the namespace.  Making a subtree private is
               local to the namespace, though, so setting MS_PRIVATE
               does not affect the outside world. */
            Strings mounts = tokenizeString<Strings>(readFile("/proc/self/mountinfo", true), "\n");
            foreach (Strings::iterator, i, mounts) {
                vector<string> fields = tokenizeString<vector<string> >(*i, " ");
                string fs = decodeOctalEscaped(fields.at(4));
                if (mount(0, fs.c_str(), 0, MS_PRIVATE, 0) == -1)
                    throw SysError(format("unable to make filesystem `%1%' private") % fs);
            if (mount(0, "/", 0, MS_REC|MS_PRIVATE, 0) == -1) {
                throw SysError("unable to make ‘/’ private mount");
            }

            /* Bind-mount chroot directory to itself, to treat it as a